diff --git a/.ciagent/ARCHITECTURE.md b/.ciagent/ARCHITECTURE.md index 5eafb23..27958f3 100644 --- a/.ciagent/ARCHITECTURE.md +++ b/.ciagent/ARCHITECTURE.md @@ -348,77 +348,63 @@ Proxmox invokes hookscript at post-start phase (runs on PVE HOST): --- -## v0.3 Architecture (Mastery Scoring + Competency Rubrics + VC + Cohort Dashboard) +## v0.3 Architecture (Mastery Scoring + Competency Rubrics + VC) -> **Status:** Research-refined (v0.3 RESEARCH stage). Informed by `.ciagent/RESEARCH.md` v0.3 section. +> **Status:** Released (v0.1.5, merged to main). Research-refined (v0.3 RESEARCH stage). > **Decisions:** D-031 (operator tier, overrides D-007 for operator surface), D-032 (mastery gate), D-033 (W3C VC 2.0), D-034 (k-anonymity), D-035 (IRT 1PL), D-036 (scenario library), D-037 (path structure), D-038..D-049 (clarify). +> **v0.4 note:** The operator-tier sections below (auth, cohort aggregation, Postgres) were anticipatory in v0.3 and are now confirmed/refined in the v0.4 section (§ v0.4 Operator-Tier Architecture). The v0.3 mastery/VC/IRT sections are released and unchanged. -### Hybrid Storage Topology (D-031) +### Hybrid Storage Topology (D-031 — confirmed in v0.4) Learner-local state stays in SQLite (D-007 preserved); operator-tier state goes to a new Postgres service. The two stores never share a session and never join via cross-DB FKs (`learner_ref` is an opaque string in Postgres). ``` -LXC Container (from v0.2, memory bumped 4GB → 6GB) +LXC Container (v0.2 4GB → v0.4 6GB) Docker daemon - ├── praxis container (existing v0.2 + v0.3 additions) + ├── praxis container (v0.2 + v0.3 + v0.4 additions) │ ├─ uvicorn 0.0.0.0:8789 │ ├─ GET /health (v0.2) │ ├─ POST /pipecat/webrtc (v0.2) - │ ├─ GET / ... StaticFiles (v0.2) - │ ├─ /api/operator/* NEW (v0.3 — operator auth gate) - │ ├─ /vc/verify/ NEW (v0.3 — public, unauthenticated) - │ ├─ SQLite /app/data/praxis.db (v0.2 + NEW v0.3 tables: learner_ability, mastery_progress) - │ └─ Postgres pool (asyncpg) (v0.3 — operator tier) + │ ├─ /vc/verify/ (v0.3 — public, unauthenticated) + │ ├─ /api/operator/* (v0.4 — operator auth gate — D-057) + │ ├─ GET / ... StaticFiles + SPA fallback (v0.2 + v0.4 SPA fallback for /operator/*) + │ ├─ SQLite /app/data/praxis.db (v0.2 + v0.3 tables: learner_ability, mastery_progress, issuer_keys, issued_credentials, status_lists) + │ └─ Postgres pool (asyncpg) (v0.4 — operator tier — D-050) │ - └── postgres container NEW (v0.3) + └── postgres container (v0.4 — D-040) ├─ postgres:16-slim ├─ pgdata named volume - ├─ internal Docker network only (no published port) + ├─ pgbackups named volume (nightly pg_dump — D-055) + ├─ praxis-net internal Docker network only (no published port) ├─ pg_isready healthcheck └─ Tables: operators, issued_credentials, mastery_gate_events, cohort_aggregates, issuer_keys ``` -### v0.3 Component Map (additions to v0.2) +### v0.3 Component Map (mastery + VC + IRT — released, unchanged) ``` Pipecat server (Python) ├─ ... (v0.2 voice loop unchanged) ... - ├─ Rubric engine NEW (server/mastery/) + ├─ Rubric engine (server/mastery/) │ ├─ rubric_loader.py (rubrics/.yaml → Pydantic) │ ├─ rubric_scorer.py (rule-based: signals → 1-5, deterministic — REQ-NFR-MAST-01) │ ├─ evidence_extractor.py (LLM extracts quotes+signals, temp=0, JSON-schema) │ └─ mastery_score.py (weighted mean + conjunctive floor + path gate) - ├─ IRT engine NEW (server/mastery/irt.py) + ├─ IRT engine (server/mastery/irt.py) │ ├─ 1PL/Rasch: P(success) = logistic(θ − b) │ ├─ Bayesian θ update per session (<100ms — REQ-NFR-IRT-01) │ └─ θ persisted to SQLite learner_ability (D-046) - ├─ Scenario library NEW (server/scenarios/library.py) + ├─ Scenario library (server/scenarios/library.py) │ ├─ scenarios//.yaml + scenarios/index.yaml (semver, rubric_criteria mapping) │ └─ AI variation review pipeline (_pending/ → expert review → library) - ├─ Path engine NEW (server/paths/) + ├─ Path engine (server/paths/) │ ├─ paths/.yaml (6-week structure, mastery gates — D-037) │ └─ progression: current_week advances on gate-open (D-048) - ├─ VC issuer NEW (server/vc/) - │ ├─ issuer.py (Ed25519, pynacl + canonicaljson + base58, eddsa-jcs-2022) - │ ├─ status_list.py (Bitstring Status List v1.0) - │ ├─ verification.py (public GET /vc/verify/ — D-043) - │ └─ issuer key in Postgres issuer_keys (encrypted at rest) - ├─ Operator auth NEW (server/auth/) - │ ├─ SessionMiddleware (Starlette, itsdangerous-signed cookie — D-041) - │ ├─ argon2id passwords (argon2-cffi) - │ ├─ current_operator Depends - │ └─ slowapi 5/min login rate-limit - ├─ Cohort aggregation NEW (server/cohort/) - │ ├─ on-session-end hook → k-anonymized aggregate upsert to Postgres (D-045) - │ └─ nightly reconciliation job (cron in praxis service) - └─ Operator API NEW (server/operator/) - ├─ /api/operator/login, /api/operator/logout - ├─ /api/operator/cohort (k-anonymized, ≥10 learners/cell — D-034) - └─ /api/operator/credentials (issued VCs, revocation) - -Client (React) - ├─ ... (v0.2 voice UI unchanged) ... - └─ /operator/* NEW (v0.3 — cohort dashboard UI, auth-gated — D-044) + └─ VC issuer (server/vc/) + ├─ issuer.py (Ed25519, pynacl + canonicaljson + base58, eddsa-jcs-2022) + ├─ status_list.py (Bitstring Status List v1.0) + ├─ verification.py (public GET /vc/verify/ — D-043) + └─ issuer_keys.py (Ed25519 key lifecycle: active/superseded, encrypted at rest — D-042) ``` ### Mastery Scoring Flow (off the voice path) @@ -478,4 +464,286 @@ Tables: `operators` (id, username, password_hash argon2id), `issued_credentials` ### v0.3 Risks (from RESEARCH.md) -Top risks for PLAN: R-MAST-01 (N=3 thin for credential → label formative), R-AUTH-01 (Secure cookie + no-TLS pilot), R-MT-01 (Postgres resource contention), R-VC-01 (custom VC code ~200 LOC), R-MAST-02 (LLM hallucinated quotes → fuzzy-match guard), R-IRT-01 (cold-start θ → fall back to scenario.difficulty until ≥5 sessions). Full table in RESEARCH.md. \ No newline at end of file +Top risks for PLAN: R-MAST-01 (N=3 thin for credential → label formative), R-AUTH-01 (Secure cookie + no-TLS pilot), R-MT-01 (Postgres resource contention), R-VC-01 (custom VC code ~200 LOC), R-MAST-02 (LLM hallucinated quotes → fuzzy-match guard), R-IRT-01 (cold-start θ → fall back to scenario.difficulty until ≥5 sessions). Full table in RESEARCH.md. + +> **v0.4 note:** R-AUTH-01 is resolved in v0.4 via config-driven `PRAXIS_COOKIE_SECURE` (see § v0.4 Operator-Tier Architecture). R-MT-01 is confirmed + mitigated (6GB CT, 03:00 CT nightly jobs). + +--- + +## v0.4 Operator-Tier Architecture (Cohort Dashboard + Auth + Postgres) + +> **Status:** Research-refined (v0.4 RESEARCH stage). Informed by `.ciagent/RESEARCH-v0.4-operator-tier.md`. +> **Decisions:** D-040 (Postgres 2nd service), D-050 (asyncpg pool + service DNS), D-051 (VC key migration), D-052 (operator bootstrap), D-053 (3 dashboard views), D-054 (async hook + nightly job), D-055 (pg_dump backup), D-056 (signed stateless cookies), D-057 (server-side auth enforcement). +> **v0.3 audit:** 2 anticipatory assumptions overturned (asyncpg min_size 2→1, weekly partitions→plain table), 1 refined (Secure cookie → config-driven). See RESEARCH-v0.4 § v0.3 Assumption Audit. + +### v0.4 Component Map (additions to v0.3) + +``` +Pipecat server (Python) + ├─ ... (v0.2 voice loop + v0.3 mastery/VC/IRT unchanged) ... + ├─ Operator auth NEW (server/auth/) (v0.4 — D-041, D-056, D-057) + │ ├─ Starlette SessionMiddleware (itsdangerous-signed cookie = HMAC-SHA256 — D-056) + │ │ ├─ cookie: praxis_op, httpOnly, SameSite=Strict, max_age=28800 (8h) + │ │ ├─ secure: config-driven PRAXIS_COOKIE_SECURE (default true; false for HTTP pilot — R-AUTH-01) + │ │ └─ secret: PRAXIS_COOKIE_SECRET (≥32 bytes, from env) + │ ├─ argon2id passwords (argon2-cffi PasswordHasher — defaults: t=3, m=64MiB, p=4 — exceeds OWASP) + │ │ └─ check_needs_rehash() on login for param upgrades + │ ├─ current_operator Depends (router-level dependencies=[...] on /api/operator/* — D-057) + │ ├─ slowapi 5/min login rate-limit (in-memory, single-instance — D-041) + │ └─ Auth middleware: 401 on missing/invalid/expired cookie for every /api/operator/* request + ├─ Cohort aggregation NEW (server/cohort/) (v0.4 — D-045, D-053, D-054) + │ ├─ on-session-end hook (async fire-and-forget asyncio.Task — D-054) + │ │ └─ chained after mastery flow; reads session outcome + rubric scores + │ │ → k-anonymized aggregate upsert to Postgres (idempotent by window) + │ ├─ nightly reconciliation job (in-process asyncio scheduler, 03:00 CT — D-054) + │ │ └─ recomputes all 7-day windows; idempotent upsert by (path, metric, window_start) + │ └─ k-anonymity suppression (write-time: COUNT(DISTINCT learner_ref) >= 10, else cell_suppressed=TRUE — D-034) + ├─ Operator API NEW (server/operator/) (v0.4 — D-053, D-057) + │ ├─ POST /api/operator/login (rate-limited 5/min, not auth-gated) + │ ├─ POST /api/operator/logout (auth-gated) + │ ├─ GET /api/operator/me (auth-gated — React route guard) + │ ├─ GET /api/operator/cohort (auth-gated — practice volume view) + │ ├─ GET /api/operator/mastery (auth-gated — mastery progression view) + │ ├─ GET /api/operator/failure-patterns (auth-gated — failure patterns view) + │ └─ GET/POST /api/operator/credentials (auth-gated — VC issuance log + revocation) + └─ Postgres store NEW (db/pg_store.py + db/pg_migrations/) (v0.4 — D-040, D-050) + ├─ asyncpg pool (app.state.pg_pool via lifespan — D-050) + │ └─ create_pool(min_size=1, max_size=10, command_timeout=10) + ├─ pg_migrate.py (mirrors db/migrate.py pattern — ordered .sql, _pg_migrations table) + └─ IssuerKeyStore protocol (PraxisStore + PgStore both implement — D-051 migration) + +Client (React) + ├─ ... (v0.2 voice UI unchanged at /) ... + ├─ React Router NEW (react-router-dom@^7) (v0.4 — D-044) + │ └─ wraps App.tsx; catch-all route serves voice UI at / + └─ /operator/* NEW (v0.4 — cohort dashboard UI, auth-gated — D-044, D-053) + ├─ /operator/login (login form → POST /api/operator/login) + ├─ /operator/dashboard (3 views: practice, mastery, failure-patterns) + ├─ Auth gate: GET /api/operator/me on mount → redirect to /operator/login if 401 + ├─ Read-only tables + inline SVG sparklines (zero-dep, ~50 LOC) + └─ Freshness indicator: "Last updated: Xh ago" (from cohort_aggregates.updated_at) + +Postgres container (v0.4 — D-040) + ├─ postgres:16-slim + ├─ pgdata named volume (PGDATA=/var/lib/postgresql/data/pgdata) + ├─ pgbackups named volume (nightly pg_dump -Fc — D-055) + ├─ praxis-net bridge network (no published port, no internal: true) + ├─ pg_isready healthcheck (10s interval, 5 retries, 5s timeout) + ├─ depends_on: service_healthy on praxis + └─ Tables: operators, issued_credentials, mastery_gate_events, cohort_aggregates, issuer_keys +``` + +### Postgres Service in docker-compose (D-040, D-050) + +```yaml +# Shape only — not for commit (v0.4 P1 implementation) +services: + praxis: + # ... existing v0.2 fields unchanged ... + depends_on: + postgres: + condition: service_healthy + networks: [praxis-net] + + postgres: + image: postgres:16-slim + restart: unless-stopped + environment: + POSTGRES_USER: praxis + POSTGRES_PASSWORD: ${PRAXIS_PG_PASSWORD} + POSTGRES_DB: praxis + PGDATA: /var/lib/postgresql/data/pgdata + env_file: + - path: /etc/praxis/server.env + required: false + volumes: + - pgdata:/var/lib/postgresql/data + - pgbackups:/backups + healthcheck: + test: ["CMD-SHELL", "pg_isready -U praxis -d praxis"] + interval: 10s + timeout: 5s + retries: 5 + networks: [praxis-net] + # NOTE: no `ports:` — not exposed to the LXC host bridge (D-040) + +volumes: + praxis-data: # existing v0.2 + driver: local + pgdata: # NEW v0.4 + driver: local + pgbackups: # NEW v0.4 + driver: local + +networks: + praxis-net: # NEW v0.4 + driver: bridge +``` + +**Connection DSN (D-050):** `postgresql://praxis:${PRAXIS_PG_PASSWORD}@postgres:5432/praxis` (host = service name on praxis-net). + +### asyncpg Pool (D-050) + +```python +# Shape only — lifespan context manager +from contextlib import asynccontextmanager +import asyncpg + +@asynccontextmanager +async def lifespan(app): + app.state.pg_pool = await asyncpg.create_pool( + dsn=os.environ["PRAXIS_PG_DSN"], + min_size=1, # D-050 (lower than v0.3 anticipatory min_size=2) + max_size=10, + command_timeout=10, + ) + try: + yield + finally: + await app.state.pg_pool.close() + +app = FastAPI(lifespan=lifespan) +``` + +The `PraxisStore` (aiosqlite) keeps its current per-call connect pattern — **pools are independent and must not be shared** (different backends, different lifecycles). + +### Auth Middleware Flow (D-056, D-057) + +``` +Client request → /api/operator/cohort + │ + ├─ Starlette SessionMiddleware + │ ├─ reads praxis_op cookie + │ ├─ validates HMAC-SHA256 signature (itsdangerous) + │ ├─ checks max_age (8h expiry) + │ └─ populates request.session = {operator_id, issued_at} (or empty if invalid) + │ + ├─ current_operator Depends (router-level) + │ ├─ reads request.session["operator_id"] + │ ├─ if missing → 401 "not authenticated" + │ ├─ fetches operator from Postgres operators table + │ ├─ if not found / not is_active → 401 + clear cookie + │ └─ returns Operator (injected into route) + │ + └─ Route handler (GET /api/operator/cohort) + └─ queries Postgres cohort_aggregates (k-anonymized) → returns JSON +``` + +**Login flow:** +``` +POST /api/operator/login {username, password} + │ + ├─ slowapi rate-limit check (5/min per IP — D-041) + │ └─ if exceeded → 429 + Retry-After + │ + ├─ fetch operator by username from Postgres + ├─ argon2-cffi PasswordHasher().verify(stored_hash, password) + │ ├─ if invalid → 401 (increment rate-limit counter) + │ └─ if valid → check_needs_rehash(stored_hash) → rehash if params bumped + │ + └─ Set signed cookie: request.session["operator_id"] = op.id + → response 200 {operator: {id, username, display_name}} +``` + +**React route guard (UX only — server is authority per D-057):** +``` +/operator/dashboard mount + │ + ├─ GET /api/operator/me (with cookie) + │ ├─ 200 → render dashboard + │ └─ 401 → redirect to /operator/login +``` + +### Aggregation Pipeline (D-045, D-053, D-054) + +``` +Session end (server/session_recorder.py) + │ + ├─ 1. Mastery flow (asyncio.Task — existing v0.3 pattern) + │ └─ evidence → rubric score → IRT θ → gate check → VC issuance + │ + └─ 2. Cohort aggregation hook (asyncio.Task — v0.4, chained after mastery) + ├─ reads session outcome + rubric scores + scenario failure_mode + ├─ computes k-anonymized aggregate for (path, metric, window_start) + ├─ COUNT(DISTINCT learner_ref) >= 10 check + │ ├─ if ≥10 → upsert value to cohort_aggregates + │ └─ if <10 → upsert with cell_suppressed=TRUE, value=NULL + └─ failures log + nightly job reconciles (idempotent) + +Nightly reconciliation (in-process asyncio scheduler, 03:00 CT) + ├─ recomputes all 7-day windows for all paths + ├─ idempotent upsert by (path, metric, window_start) + └─ guarantees REQ-NFR-DASH-02 (freshness ≤ 24h) +``` + +### 3 Dashboard Views (D-053) + +| View | Endpoint | Metrics (k-anonymized, 7-day windows) | +|------|----------|---------------------------------------| +| Practice volume | GET /api/operator/cohort | sessions/day per path; total sessions; active learners (suppressed if <10) | +| Mastery progression | GET /api/operator/mastery | % learners at each week (1-6); gate-open rate; median mastery_score; rubric criterion means | +| Failure patterns | GET /api/operator/failure-patterns | top failure_modes by frequency; rubric criteria with mean < 3.0; branch outcome distribution | + +All views: read-only tables + inline SVG sparklines; no per-learner drill-down (k-anon); suppressed cells shown as "— (<10 learners)". + +### Postgres Schema (operator tier — D-040, refined by D-050..D-053) + +Tables: `operators` (id UUID DEFAULT gen_random_uuid(), username TEXT UNIQUE, password_hash TEXT argon2id, display_name TEXT, role TEXT DEFAULT 'operator', is_active BOOLEAN DEFAULT TRUE, created_at TIMESTAMPTZ, last_login_at TIMESTAMPTZ), `issued_credentials` (id UUID, operator_id UUID REFERENCES operators, learner_ref TEXT opaque, vc_type TEXT, payload_jsonb JSONB, issued_at TIMESTAMPTZ, revoked_at TIMESTAMPTZ), `mastery_gate_events` (id UUID, learner_ref TEXT, scenario_id TEXT, path_id TEXT, gate_outcome TEXT, recorded_at TIMESTAMPTZ, source TEXT DEFAULT 'sync'), `cohort_aggregates` (path TEXT, metric TEXT, window_start DATE, window_end DATE, value NUMERIC, cell_count INTEGER, cell_suppressed BOOLEAN, updated_at TIMESTAMPTZ, PRIMARY KEY (path, metric, window_start) — **plain table, not partitioned** (v0.4 scale; add partitioning post-pilot)), `issuer_keys` (id TEXT, public_key TEXT, private_key_enc BYTEA, status TEXT active|superseded, created_at TIMESTAMPTZ). `gen_random_uuid()` in PG16 core (no extension). No cross-DB FKs. + +### VC Key Migration (D-042, D-051) + +``` +v0.4 first boot: + │ + ├─ 1. Postgres issuer_keys table created (pg_migrate.py) + │ + ├─ 2. Read v0.3 active public key from SQLite issuer_keys + │ └─ insert into Postgres issuer_keys with status='superseded' + │ (private key NOT migrated — only public key archived for verification) + │ + ├─ 3. Generate fresh Ed25519 keypair in Postgres issuer_keys (status='active') + │ └─ private key encrypted at rest via nacl.SecretBox (PRAXIS_VC_ISSUER_KEY root key) + │ + └─ 4. Verification endpoint (server/vc/verification.py): + ├─ extract key_id from proof.verificationMethod + ├─ get_public_key_for_verification(store, key_id) + │ └─ queries by id (not status) → finds active OR superseded keys + └─ verify_proof(secured_doc, verify_key) + ├─ v0.3 VCs → v0.3 key_id → archived (superseded) public key → verifies ✓ + └─ v0.4 VCs → v0.4 key_id → active public key → verifies ✓ +``` + +**IssuerKeyStore protocol:** the existing `server/vc/issuer_keys.py` functions take a `PraxisStore` (SQLite). v0.4 refactors to an `IssuerKeyStore` protocol/ABC with methods `init_issuer_key`, `get_active_signing_key_row`, `get_public_key_row`, `set_issuer_key_superseded`. Both `PraxisStore` (SQLite, for v0.3 compat) and `PgStore` (Postgres, for v0.4) implement it. + +### Backup Strategy (D-055) + +``` +Host-side cron (decoupled from praxis service uptime): + 03:30 CT nightly: + docker compose exec -T postgres pg_dump -U praxis -Fc praxis \ + -f /backups/praxis-$(date +%u).dump + → pgbackups named volume, %u = day-of-week 1-7 → rolling 7-file retention + +Restore drill: + docker compose exec postgres pg_restore -U praxis -d praxis \ + --clean --if-exists /backups/praxis_3.dump + (never restore into live DB without stopping praxis first) +``` + +### CT Resource Sizing (v0.4 bump) + +| Resource | v0.2 | v0.3 (anticipatory) | v0.4 (confirmed) | Rationale | +|----------|------|---------------------|------------------|-----------| +| Memory | 4096 MB | 6144 MB | **6144 MB** | Postgres ~400MB + praxis ~500MB + Docker ~200MB + build headroom ~1GB + margin | +| Rootfs | 16 GB | 16 GB | **16 GB** | Postgres data on pgdata named volume, not rootfs; pgbackups on named volume | +| CPU | 2 | 2-4 | **2-4** | Postgres + praxis concurrent; 2 floor, 4 preferred | + +### v0.4 Risks (from RESEARCH-v0.4-operator-tier.md) + +Top risks for PLAN: R-AUTH-01 (Secure cookie + no-TLS → config-driven flag, grill must sign off), R-VC-MIG-01 (VC key migration loses v0.3 public key → archive as superseded before activating new key), R-DASH-03 (SPA fallback breaks voice UI → catch-all route before StaticFiles mount), R-MT-01 (Postgres resource contention → 03:00 CT nightly jobs, 6GB CT). Full table (20 risks) in RESEARCH-v0.4-operator-tier.md. + +### v0.4 New Dependencies + +**Pip (pyproject.toml):** `asyncpg>=0.29` (Postgres driver), `argon2-cffi>=23.1` (password hashing), `slowapi>=0.1` (rate limiting). `pynacl`, `canonicaljson`, `base58` already present (v0.3). + +**Npm (client/package.json):** `react-router-dom@^7` (React routing for /operator/*). No chart library — inline SVG sparklines (zero deps). \ No newline at end of file diff --git a/.ciagent/CHECKPOINT.json b/.ciagent/CHECKPOINT.json index 745395b..3ee2423 100644 --- a/.ciagent/CHECKPOINT.json +++ b/.ciagent/CHECKPOINT.json @@ -1,18 +1,19 @@ { - "phase": 2, - "stage": "complete", - "milestone": "v0.3", - "phase_role": "final", + "phase": 0, + "stage": "grill", + "milestone": "v0.4", + "phase_role": "pre_execution", "attempts": 0, - "updated_at": "2026-08-03T21:55:00Z", - "milestone_complete": true, - "milestone_merged_to_main": true, - "tag": "v0.1.5", - "release_url": "https://git.cloudinit.dev/coreci/praxis/releases/tag/v0.1.5", - "release_status": "created", - "next_milestone": "v0.4", + "updated_at": "2026-08-04T02:15:00Z", + "milestone_complete": false, + "milestone_merged_to_main": false, + "tag": null, + "release_url": null, + "release_status": null, + "next_milestone": null, "requirements": { - "covered": ["REQ-MAST-01", "REQ-MAST-02", "REQ-MAST-03", "REQ-SCEN-02", "REQ-SCEN-03", "REQ-SCEN-04", "REQ-PATH-02", "REQ-NFR-MAST-01", "REQ-NFR-MAST-02", "REQ-NFR-VC-01", "REQ-NFR-VC-02", "REQ-NFR-IRT-01"], - "deferred": ["REQ-DASH-01", "REQ-AUTH-01", "REQ-MT-01", "REQ-MT-02", "REQ-NFR-DASH-01", "REQ-NFR-DASH-02", "REQ-NFR-AUTH-01", "REQ-NFR-MT-01"] + "covered": [], + "active": ["REQ-MT-01", "REQ-MT-02", "REQ-AUTH-01", "REQ-DASH-01", "REQ-NFR-AUTH-01", "REQ-NFR-MT-01", "REQ-NFR-DASH-01", "REQ-NFR-DASH-02"], + "deferred": [] } } \ No newline at end of file diff --git a/.ciagent/GRILL-v0.4.md b/.ciagent/GRILL-v0.4.md new file mode 100644 index 0000000..6e05f1b --- /dev/null +++ b/.ciagent/GRILL-v0.4.md @@ -0,0 +1,616 @@ +# CIAgent Grill Report — v0.4 Operator Tier + +## Run: 2026-08-04 (mode: mechanical, focus: all axes + 6 v0.4-specific probes) + +> **Reviewer:** adversarial technology executive (red-team) +> **Subject:** v0.4 execution plan (Operator Tier — Cohort Dashboard + Auth + Postgres) — 2 execution phases, 10 slices, 52 tasks +> **Stance:** plan is unfeasible, over-scoped, and too costly until evidence forces otherwise +> **Artifacts reviewed:** PROJECT.md, REQUIREMENTS.md, ROADMAP.md, ARCHITECTURE.md, RESEARCH-v0.4-operator-tier.md, PERSONAS.md, PLAN-v0.4-operator-tier.md, GRILL-v0.3.md, config.json, docker-compose.yml, server/session_recorder.py, server/vc/issuer_keys.py, server/__main__.py, db/store.py +> **Binding status:** This grill verdict must be cleared (MUSTs resolved, FIXs tracked) before EXECUTE is authorized. + +--- + +### Verdict: Proceed-with-conditions (confidence: 0.72) + +The v0.4 plan is well-researched, cleanly phased, and honors the v0.3 grill's binding verdict (operator tier deferred, formative label applied, scoring_inconclusive fallback implemented, VC interop + key-rotation drills shipped in v0.3 codebase — all verified). The architecture is sound and the risk register is the most honest in the project's history (20 risks, 1 high, 9 medium, 11 low — all addressed). However, three material issues must be resolved before EXECUTE: (1) R-AUTH-01 is a *partial* resolution that re-litigates a v0.3 grill MUST — the config-driven flag is a punt, not a fix, and the cohort-dashboard-reads-only-aggregates defense-in-depth is the *real* mitigation, which should be elevated; (2) the k-anonymity-at-pilot-scale problem means v0.4 ships a dashboard that cannot display any data at production pilot scale (1 learner) — this is a *real deliverable* only if test-seeded data is treated as the validation path, which the plan does but does not emphasize; (3) the VC key migration verification endpoint now queries *two* stores (Postgres for keys, SQLite-fallback for v0.3 credentials) — a complexity the plan defers to "open question #1" but which is on the critical path of R-VC-MIG-01. + +The plan is **not** over-scoped (8 REQs, cleanly split P1 infra / P2 feature). It is **not** unfeasible (52 tasks vs v0.3's 40, analogous). It is **not** a zombie (the operator tier was the explicitly-deferred v0.3 scope, now delivered). The conditions are binding but surgical. + +--- + +### Axis 1 — Business Case + +- **Q1: What problem does v0.4 solve, and is it the top priority?** + - Evidence: GRILL-v0.3.md Axis 2 MUST #1 — "defer REQ-DASH-01 + operator tier to v0.4"; ROADMAP.md:9 — "v0.4 activates the operator tier deferred from v0.3 per the grill's binding verdict"; PROJECT.md:47 — "v0.4 layers the operator surface on top of it." + - Answer: v0.4 delivers the operator tier that the v0.3 grill explicitly split out. The operator tier (cohort dashboard + auth + Postgres) was originally v0.8 on the ROADMAP (GRILL-v0.3.md:44), pulled to v0.3, then split to v0.4 by the grill. This is the *deferred obligation*, not new scope. The priority is correct: v0.3 shipped the learner-facing mastery layer; v0.4 ships the operator-facing visibility layer. The alternative (multi-path / Live Assist / low-bandwidth) would expand the learner surface before the operator surface exists to observe it. + - Confidence: 0.85 + - Decision: **G-001** — v0.4 operator tier is the correct next priority (delivers the v0.3 grill's deferred obligation). (0.85) + +- **Q2: Who is the named executive sponsor for the operator tier?** + - Evidence: config.json:13 — `"level": "full"`; config.json:16 — `"decision_confidence_threshold": 0.6`; PROJECT.md:5 — "Autonomy: full." + - Answer: No human sponsor. The CI agent is the executive sponsor under full autonomy. This is the project's established governance model since v0.1. The v0.3 grill accepted this (no escalation on governance). The "sponsor makes a decision under pressure" test is met by the grill itself — this document is the pressure decision. + - Confidence: 0.80 + - Decision: **G-002** — CI is the named sponsor under full autonomy (no change from v0.1-v0.3 governance). (0.80) + +- **Q3: What happens to the business if v0.4 is cancelled?** + - Evidence: ROADMAP.md:131-139 — future milestones (v0.5 Live Assist, v0.6 low-bandwidth) do not depend on the operator tier; v0.9 credentialing depends on VC issuer (v0.3, already shipped). The learner-facing product (v0.1-v0.3) works without the operator tier. + - Answer: If v0.4 is cancelled, the learner product continues to function. The operator tier is a *visibility* feature, not a *learner-path* feature. However, cancelling v0.4 means the v0.3 grill's binding verdict (defer to v0.4) becomes a *permanent deferral* — the operator tier was promised and not delivered. This would be the first broken grill commitment. The project is not a zombie (cancelling has a cost: the grill's credibility), but the operator tier is a nice-to-have for the pilot, not a blocker for a pilot deployment. A pilot can run with a single learner and no dashboard. + - Confidence: 0.75 + - Challenge: The operator tier's business value at pilot scale (1 learner, k-anon suppresses everything) is low. The dashboard will show "— (<10 learners)" for every cell. This is a *placeholder deliverable* unless multi-learner data is seeded. The plan acknowledges this (Open Question #3) but does not treat it as a material risk to the business case. + - Decision: **G-003** — v0.4 is not a zombie (delivers a grill obligation) but its pilot-scale business value is low (k-anon suppresses all cells with 1 learner). The dashboard's validation path is test-seeded data (≥10 mock learners), not pilot traffic. This must be documented in the ship notes. (0.75) + +- **Q4: Is the ROI calculated against a counterfactual?** + - Evidence: MISSING — no ROI calculation in any `.ciagent/` file. The project is a pre-revenue pilot (D-012 — no enforced cost ceiling for pilot). + - Answer: No ROI calculation exists. The counterfactual is "ship v0.4 vs skip to v0.5 (Live Assist)." Shipping v0.4 costs ~52 tasks of tokens + a Postgres service + 3 new pip deps + 1 new npm dep. Skipping to v0.5 would leave the operator tier permanently deferred (broken grill commitment) and Live Assist would build on a learner surface with no operator visibility. The ROI is *governance credibility* + *operator visibility foundation for v0.5+*, not a financial return. + - Confidence: 0.65 + - Decision: **G-004** — no financial ROI; the ROI is governance credibility (delivering the grill's deferred obligation) + architectural foundation (Postgres + auth for v0.5+). Accept the non-financial ROI under full autonomy. (0.65) + +--- + +### Axis 2 — Scope and Requirements + +- **Q1: Is v0.4 scope stable? (8 REQs from v0.3 grill deferral — clean handoff, or new scope creep?)** + - Evidence: GRILL-v0.3.md Axis 2 MUST #1 — "defer REQ-DASH-01 + REQ-AUTH-01 + REQ-MT-01/02 + 4 NFRs to v0.4"; REQUIREMENTS.md:8-36 — v0.4 activates exactly those 8 REQs; PROJECT.md:49-54 — v0.4 in-scope matches the deferred set. + - Answer: Clean handoff. The 8 REQs activated in v0.4 are exactly the 8 REQs the v0.3 grill deferred. No new REQs were added. No scope creep. The scope is *contracting* relative to the v0.3 plan (which originally included these + the mastery layer). + - Confidence: 0.90 + - Decision: **G-005** — v0.4 scope is a clean handoff from the v0.3 grill deferral. No scope creep. (0.90) + +- **Q2: Who owns the requirements, and are they frozen?** + - Evidence: config.json:13 — full autonomy; PROJECT.md:5 — "Autonomy: full"; REQUIREMENTS.md:8-36 — 8 active REQs with Phase + Status columns. + - Answer: CI owns the requirements under full autonomy. They are frozen at the SPECIFY stage (commit 1b5173e — "validate specification"). The CLARIFY stage (commit 4f565d6) added D-050..D-057 but did not add/remove REQs. Frozen. + - Confidence: 0.85 + - Decision: **G-006** — requirements are frozen (8 REQs, CI-owned under full autonomy). (0.85) + +- **Q3: What is explicitly out of scope?** + - Evidence: PROJECT.md:56-65 — explicit out-of-scope list; REQUIREMENTS.md:38-48 — out-of-scope list. + - Answer: Explicitly out of scope: multi-path launch, full operator-suite dashboard (REQ-DASH-02), Live Assist, low-bandwidth, multi-language, persona switching, learner auth, RBAC (single operator role), third-party credential issuers, differential privacy. The out-of-scope list is the most explicit in the project's history. Single operator role (no RBAC) is the key constraint — v0.4 ships one role. + - Confidence: 0.88 + - Decision: **G-007** — out-of-scope is explicit and comprehensive (RBAC, learner auth, DP, multi-path all deferred). (0.88) + +- **Q4: Hidden requirements? (TLS for secure cookies? Postgres backup verification? Operator account lifecycle — deactivation, password reset?)** + - Evidence: RESEARCH-v0.4 §2.4 — R-AUTH-01 acknowledges the Secure-cookie+no-TLS tension; D-055 — backup strategy defined (pg_dump, 7-day retention); D-052 — operator bootstrap CLI; PROJECT.md:62 — "RBAC deferred (one role)." + - Answer: + - **TLS for secure cookies**: NOT a hidden requirement — it is the explicit R-AUTH-01 tension, resolved (partially) by config-driven `PRAXIS_COOKIE_SECURE`. See Axis 3 + signature probe. + - **Postgres backup verification**: The plan defines a backup strategy (TASK-02-03 — backup cron script) but **does NOT define a backup verification / restore drill**. The script comments mention `pg_restore --clean --if-exists` but there is no task that *executes* a restore and verifies data integrity. A backup that is never restored is an unverified backup. This is a hidden requirement. + - **Operator account lifecycle (deactivation, password reset)**: D-052 defines bootstrap (creation) + a `--update` flag (password rehash). The `operators` table has `is_active` (TASK-03-04 handles inactive → 401). But **there is no operator deactivation task** — no CLI to set `is_active=false`, no UI for it. Password reset = `create-operator.py --update` (documented). Deactivation is a gap, but minor (single operator, can be done via SQL if needed). Not a blocker. + - Confidence: 0.70 + - Challenge: Backup verification is a hidden requirement. A nightly pg_dump that is never restored is theater, not a backup. + - Decision: **G-008 (MUST)** — Add a backup-restore drill task to P1 (either in SLICE-02 or SLICE-06): execute `pg_restore --clean --if-exists` against a test Postgres instance, verify the 5 tables + row counts match. This is a one-task addition. The restore drill must run at least once in CI/staging to prove the backup is valid. (0.70) + +--- + +### Axis 3 — Architecture and Technical Feasibility + +- **Q1: Has the Postgres-in-LXC + asyncpg + auth + dashboard architecture been validated by operators, or only by the plan?** + - Evidence: RESEARCH-v0.4 §1.1-1.7 — Postgres 16-slim resource footprint analysis (0.88 confidence); §2.1-2.6 — argon2id + SessionMiddleware (0.88); §4.1-4.5 — React Router + SPA fallback (0.85). No external operator validation (full autonomy — CI is the operator). + - Answer: The architecture is validated by research (vendor docs, OWASP, ecosystem knowledge) and codebase inspection (existing `session_recorder.py:143` asyncio.create_task pattern, existing `issuer_keys.py` lifecycle). It is NOT validated by an external operator (none exists). The asyncpg pool pattern (lifespan context manager) is standard FastAPI. The Starlette SessionMiddleware is the documented FastAPI session pattern. The SPA fallback (catch-all before StaticFiles) is the standard React-in-FastAPI pattern. The architecture is *conventional* — no novel combinations. + - Confidence: 0.80 + - Decision: **G-009** — architecture is conventional (standard FastAPI + Postgres + React patterns), research-validated. No external operator exists (full autonomy). Accept. (0.80) + +- **Q2: Integration surface — Postgres 16, asyncpg, Starlette SessionMiddleware, slowapi, argon2-cffi, react-router-dom. Risk of quiet cost doubling?** + - Evidence: PLAN-v0.4:770-771 — 3 new pip deps (asyncpg, argon2-cffi, slowapi) + 1 new npm dep (react-router-dom). RESEARCH-v0.4 §new-deps. + - Answer: 4 new dependencies. Each is a CVE vector + version-pin burden. asyncpg is the most consequential (new DB driver — connection pool lifecycle, statement cache, type coercion). slowapi is the youngest (maintenance risk — RESEARCH-v0.4 §2.5 notes "young lib, but works" at 0.70 confidence). argon2-cffi is mature (reference impl wrapper). react-router-dom@^7 is the standard React router (mature, but v7 is a major version — the `` API is stable). The cost-doubling risk is low — these are all single-purpose, well-scoped deps. The *real* cost is the Postgres service (memory, disk, backup, migration runner) — but that is budgeted (6GB CT, pgdata/pgbackups volumes). + - Confidence: 0.78 + - Decision: **G-010** — 4 new deps, all single-purpose and well-scoped. Cost-doubling risk is low. slowapi is the youngest dep — the plan documents a hand-rolled counter fallback (RESEARCH-v0.4 §2.5). Accept with the fallback documented. (0.78) + +- **Q3: Is there an existing system being replaced? (VC issuer key store SQLite→Postgres — migration path for existing issued VCs?)** + - Evidence: server/vc/issuer_keys.py (128 lines) — current SQLite-backed key store; D-051 — migration strategy; PLAN-v0.4 SLICE-04 — VC key migration slice; TASK-06-05 — R-VC-MIG-01 e2e test. + - Answer: The VC issuer key store is being migrated (SQLite→Postgres). The v0.3 `issued_credentials` table remains in SQLite (no data migration — D-051 "no re-issuance"). The verification endpoint (TASK-04-04) will try Postgres for keys, fall back to SQLite for v0.3 credentials. This is a *two-store verification path* — a complexity that is on the critical path of R-VC-MIG-01. + - Confidence: 0.75 + - Challenge: The two-store verification path (Postgres for keys, SQLite-fallback for v0.3 credentials) is a *hidden complexity*. Open Question #1 (PLAN-v0.4:742) defers this to EXECUTE: "the executor should choose the simpler approach." But this is not an implementation detail — it is an architectural decision that affects the verification endpoint's failure modes. If Postgres is down, can v0.3 credentials still verify? The plan says TASK-04-04 "try Postgres first, fall back to SQLite" but TASK-06-03 says "if pg_store is None, fall back to PraxisStore path (v0.3 compat)." These two fallback semantics are *consistent* but the plan does not make the consistency explicit. + - Decision: **G-011 (MUST)** — The verification endpoint's two-store fallback semantics must be explicit in the plan, not deferred to EXECUTE. Rule: (a) if Postgres is available, use it for key lookup (both active + superseded keys); (b) if Postgres is available but the credential is not found in Postgres `issued_credentials`, fall back to SQLite `issued_credentials` (v0.3 credentials); (c) if Postgres is NOT available (no DSN), use the existing v0.3 SQLite path for both keys + credentials. This must be documented in TASK-04-04 and TASK-06-03 as a binding contract, not an open question. (0.75) + +- **Q4: Technical debt inherited — v0.3's SQLite VC issuer keys, single hardcoded learner profile, no TLS in the LXC pilot.** + - Evidence: db/store.py:29 — `HARDCODED_LEARNER_ID = "learner-1"`; server/__main__.py:46 — `HOST = _env("PRAXIS_HOST", "0.0.0.0")` (binds to all interfaces, not loopback); D-030 — no Traefik/TLS for pilot. + - Answer: Three inherited debts: + 1. **SQLite VC issuer keys** — being migrated (D-051). This is v0.4's *job*, not inherited debt. + 2. **Single hardcoded learner profile** — `HARDCODED_LEARNER_ID = "learner-1"`. This is the *root cause* of the k-anon-at-pilot-scale problem (see signature probe #3). Not addressed in v0.4 (multi-learner-per-device is deferred). The aggregation pipeline groups by `learner_ref` but there is only one `learner_ref`. The dashboard will suppress everything. + 3. **No TLS in the LXC pilot** — D-030. This is the root cause of R-AUTH-01 (see signature probe #1). Not addressed in v0.4 (TLS deferred to a later milestone). + - Confidence: 0.72 + - Decision: **G-012** — three inherited debts acknowledged: (1) SQLite VC keys → being migrated (v0.4's job); (2) single hardcoded learner → not addressed (k-anon suppresses all pilot data); (3) no TLS → not addressed (R-AUTH-01 config-driven punt). Debts #2 and #3 are accepted as pilot-scale constraints with documented mitigations. (0.72) + +--- + +### Axis 4 — People, Skills, and Organization + +- **Q1: Key-person dependency — which 2-3 personas, if absent, would v0.4 fail?** + - Evidence: PERSONAS.md v0.4 roster — 6 active personas; PLAN-v0.4:79-86 + :419-426 — persona load distribution. + - Answer: The 3 critical personas: + 1. **security-engineer** — owns VC key migration (R-VC-MIG-01, high severity) + auth stack (argon2id, cookies, rate limit). If absent, the highest-severity risk is unowned. 8 tasks in P1. + 2. **data-engineer** — owns Postgres schema + migration runner + PgStore + IssuerKeyStore protocol. If absent, the foundation (SLICE-01) is unowned. 8 tasks in P1 + 3 in P2. + 3. **backend-engineer** — owns asyncpg pool wiring + operator API (8 endpoints) + aggregation pipeline + SPA fallback + session_recorder extension. The largest task surface (16 tasks across P1+P2). If absent, the integration slices (SLICE-06, SLICE-10) have no owner. + The lead-developer is coordination (not key-person — can be covered by backend-engineer). The frontend-engineer is P2-only (dashboard UI). The devops-engineer is P1-only (compose + backup + bootstrap). The key-person risk is concentrated in security + data + backend. + - Confidence: 0.82 + - Decision: **G-013** — key-person dependency: security-engineer, data-engineer, backend-engineer. All 3 are critical-path. Under full autonomy with parallelization (max 5 concurrent), this is manageable. Accept. (0.82) + +- **Q2: Are the 6 personas actually available?** + - Evidence: config.json:22-27 — parallelization enabled, max 5 concurrent; PERSONAS.md — 6 active personas (lead, backend, frontend, data, security, devops). security-engineer + devops-engineer are NOT in config.json personas array (emergent — defined in PERSONAS.md, per PERSONAS.md:542). + - Answer: All 6 are "available" in the sense that the CI agent spawns them on demand. The config.json `personas` array has only 4 (lead, backend, frontend, data); security + devops are emergent (PERSONAS.md). Territory enforcement is `warn` (config.json:51) — so emergent personas are not blocked. The max-concurrent-agents is 5, but 6 personas are active — one will be idle at peak. The P1 wave-2 has 3 parallel slices (SLICE-03, 04, 05) — 3 personas active (security, security, devops). The P2 wave-1 has 3 parallel slices (SLICE-07, 08, 09) — 3 personas (backend, backend, frontend). The 5-agent limit is not a binding constraint. + - Confidence: 0.80 + - Decision: **G-014** — 6 personas available (4 in config + 2 emergent), max 5 concurrent. The 6>5 mismatch is not binding (peak parallelism is 3 slices). Accept. (0.80) + +- **Q3: Product owner with authority?** + - Evidence: config.json:13 — full autonomy; PROJECT.md:5. + - Answer: CI is the product owner under full autonomy. This is the established model since v0.1. No committee. The grill is the pressure-test. + - Confidence: 0.85 + - Decision: **G-015** — CI is the product owner with full authority (no change). (0.85) + +- **Q4: Is the team building capability they don't have? (Postgres admin, k-anonymity, argon2id — all new to the project)** + - Evidence: RESEARCH-v0.4 §1-7 — all 7 domains are new to the project (Postgres 16, asyncpg, argon2id, Starlette SessionMiddleware, slowapi, k-anonymity, React Router); PERSONAS.md v0.4 — data-engineer expands to Postgres, security-engineer expands to argon2id + slowapi. + - Answer: Yes — the team is building capability it doesn't have. Postgres admin (migrations, pool, backup), k-anonymity (write-time suppression SQL), argon2id (OWASP params), signed cookies (Starlette SessionMiddleware), React Router (SPA fallback). All new. However: (a) this is a *pilot*, not a production system — learning-as-you-go is acceptable for prototypes per the grill's stance; (b) the research is thorough (OWASP fetched 2026-08-04, Postgres 16 docs verified, asyncpg pattern validated); (c) the highest-risk new capability (custom VC crypto) was already shipped in v0.3 with interop + rotation tests (verified in codebase: test_vc_interop.py, test_vc_key_rotation_drill.py). The v0.4 new capabilities are *conventional* (standard FastAPI + Postgres + React patterns), not novel. + - Confidence: 0.75 + - Decision: **G-016** — team is building new capability (Postgres, auth, k-anon, React Router) but all are conventional patterns with thorough research. Accept for pilot. (0.75) + +--- + +### Axis 5 — Timeline and Estimates + +- **Q1: Was the 2-execution-phase structure set before or after the scope was understood?** + - Evidence: ROADMAP.md:31-53 — P1/P2/P3 structure defined in ROADMAP (pre-PLAN); PLAN-v0.4:14-22 — phase split rationale refines the ROADMAP structure. + - Answer: The ROADMAP defined P1 (operator foundation) + P2 (cohort dashboard) + P3 (review) *before* the PLAN. The PLAN refined the split (6 slices in P1, 4 in P2). The scope was understood at ROADMAP time (8 REQs from v0.3 grill deferral). The deadline (per-phase ship tags v0.1.7, v0.1.8, v0.1.9) was set in ROADMAP. This is *not* a reverse-engineered deadline — the phases are defined by scope (P1 = infra/auth, P2 = dashboard), not by a target date. + - Confidence: 0.85 + - Decision: **G-017** — phase structure set after scope was understood (ROADMAP post-grill). Not reverse-engineered. (0.85) + +- **Q2: Critical path — what single thing would push v0.4 by a phase?** + - Evidence: PLAN-v0.4 wave dependency graphs (P1:60-75, P2:404-415); RESEARCH-v0.4 risks R-VC-MIG-01 (high), R-MT-01 (medium), R-DASH-03 (medium). + - Answer: The critical path is P1 Wave 1 → Wave 2 → Wave 3 → P2 Wave 1 → Wave 2. The single thing that would push v0.4 by a phase: + - **Most likely: SPA fallback breaking the voice UI (R-DASH-03/05).** The catch-all route (`@app.get("/{path:path}")`) before StaticFiles is a change to `server/__main__.py` — the *same file* that serves the voice loop. If the catch-all shadows StaticFiles asset serving (JS/CSS), the voice UI breaks. TASK-10-04 tests this (8 assertions), but if the test fails, the fix is non-trivial (route ordering in FastAPI is subtle). This would push P2 by a wave. + - **Less likely: VC key migration (R-VC-MIG-01).** The e2e test (TASK-06-05) is thorough, but if the v0.3 public key fails to verify against the Postgres store (e.g., key_id mismatch, encoding issue), the migration is blocked. The mitigation (archive before activate) is correct, but the *test* is the proof. + - **Least likely: Postgres resource contention (R-MT-01).** 6GB CT has ~50% margin. The nightly jobs are at 03:00 CT. This is a measurement issue, not a design issue. + - Confidence: 0.75 + - Decision: **G-018** — critical-path risk: SPA fallback breaking voice UI (R-DASH-03). Mitigation: TASK-10-04 (8 assertions). If it fails, the fix is route ordering. Accept with the test as the gate. (0.75) + +- **Q3: Are the 52 tasks evidence-based or pulled from a target?** + - Evidence: PLAN-v0.4:764 — 52 tasks (29 P1 + 23 P2); GRILL-v0.3.md:29 — v0.3 had 70 tasks (originally) → shipped as ~40 after the grill split; ROADMAP.md:81 — v0.3 P1 shipped as v0.1.4. + - Answer: v0.3 shipped ~40 tasks (post-grill split) successfully. v0.4 has 52 tasks across 2 phases (29 + 23). The task count is *analogous* to v0.3 (40 tasks → 52 tasks, +30%). The scope is comparable (v0.3 mastery+VC vs v0.4 operator tier). The tasks are bottom-up sized (each slice has 3-7 tasks with acceptance criteria). Not pulled from a target. + - Confidence: 0.80 + - Decision: **G-019** — 52 tasks is evidence-based (analogous to v0.3's 40, bottom-up sized). Accept. (0.80) + +- **Q4: Definition of done?** + - Evidence: PLAN-v0.4 — per-slice acceptance criteria; ROADMAP.md:16-20 — per-phase ship + verify; config.json:28-33 — verification automated. + - Answer: Definition of done = per-slice acceptance criteria (each task has "Acceptance criteria") + per-phase ship (v0.1.7, v0.1.8) + verify stage. The grill is the P0 definition of done. This is the established pattern since v0.2. + - Confidence: 0.85 + - Decision: **G-020** — definition of done is per-slice acceptance criteria + per-phase ship + verify. Established pattern. Accept. (0.85) + +--- + +### Axis 6 — Budget and Financial Realism + +- **Q1: Budget spent vs remaining?** + - Evidence: git log — v0.1 (foundation) + v0.2 (LXC deploy) + v0.3 (mastery+VC) shipped; v0.4 is the 4th milestone. No token budget tracked in `.ciagent/` (token cost is implicit in the CI agent's operation). + - Answer: No explicit token budget. The project has shipped 3 milestones (v0.1-v0.3) — the token cost is sunk. v0.4 is the 4th. Under full autonomy, the "budget" is the CI agent's operational cost (tokens + compute). No budget contingency is tracked. This is a pilot — the budget is "whatever it costs to ship the milestones." Not a financial-realism concern at pilot scale. + - Confidence: 0.75 + - Decision: **G-021** — no explicit token budget (pilot, full autonomy). v0.4 is the 4th milestone. Accept the implicit budget model. (0.75) + +- **Q2: Predictable cost drivers not in original budget? (Postgres 16 in LXC = CT memory bump 4GB→6GB; new deps = larger Docker image; backup storage)** + - Evidence: RESEARCH-v0.4 §1.1 — CT memory 4GB→6GB (confirmed); PLAN-v0.4 TASK-02-02 — CT bump; TASK-02-03 — backup volume; ARCHITECTURE.md:737 — v0.4 CT sizing. + - Answer: Three cost drivers: + 1. **CT memory 4GB→6GB** — budgeted (TASK-02-02). The 6GB figure has ~50% margin (RESEARCH-v0.4 §1.1). + 2. **Larger Docker image** — asyncpg + argon2-cffi + slowapi add ~10-20MB to the image. Negligible. + 3. **Backup storage** — pgbackups named volume, 7-day retention, pg_dump -Fc (compressed). At v0.4 scale (<100 learners), each dump is <1MB. 7 files = <7MB. Negligible. + - Confidence: 0.85 + - Decision: **G-022** — cost drivers are budgeted (6GB CT, backup volume). Image size + backup storage are negligible at pilot scale. Accept. (0.85) + +- **Q3: Burn rate — how long until v0.4 ships at current pace?** + - Evidence: git log — v0.3 took ~1 day (commits from 2026-08-03 to 2026-08-04); v0.2 similar. v0.4 has 52 tasks vs v0.3's 40. + - Answer: v0.3 shipped in ~1 day. v0.4 is +30% larger (52 vs 40 tasks). Expected: ~1.3 days of CI agent time. The burn rate is the CI agent's token consumption — not tracked, but the pace is established (3 milestones in ~3 days). + - Confidence: 0.75 + - Decision: **G-023** — burn rate: ~1.3 days estimated (analogous to v0.3). Accept. (0.75) + +- **Q4: Budget contingent on anything?** + - Evidence: config.json:13 — full autonomy; config.json:39-43 — git auto-commit, no auto-push. + - Answer: No. Full autonomy, no external approval, no contingent funding. The only contingency is the `escalation_hooks` (deploy, delete_data, merge_to_main) — none of which apply to v0.4 P0/P1/P2 execution (merge_to_main is P3, which is the final ship). + - Confidence: 0.90 + - Decision: **G-024** — no budget contingency (full autonomy, no external approval). Accept. (0.90) + +--- + +### Axis 7 — Risks, Assumptions, and Dependencies + +- **Q1: Top 3 assumptions v0.4 rests on — evidence for each?** + - Evidence: RESEARCH-v0.4 risks table (R-MT-01, R-AUTH-01, R-DASH-01). + - Answer: + 1. **Postgres-in-LXC won't destabilize the learner service (R-MT-01).** Evidence: RESEARCH-v0.4 §1.1 — Postgres idle ~400MB, praxis ~500MB, 6GB CT has ~50% margin. Postgres queries are off the voice path (operator endpoints + nightly aggregation only). The nightly jobs are at 03:00 CT. **Confidence: 0.75** — the memory math is sound but the *disk I/O contention during pg_dump* is unmeasured. The mitigation (03:00 CT) is a scheduling assumption, not a measurement. + 2. **k-anonymity ≥ 10 is sufficient privacy (D-034).** Evidence: RESEARCH-v0.4 §3.1 — "k=10 is the textbook suppression pattern." Differencing attacks blocked by pre-defined 2-D views. **Confidence: 0.70** — k=10 is the conventional minimum, but at pilot scale (1 learner) k-anon suppresses *everything*, which is privacy-correct but value-destroying. The assumption holds for privacy; it does not hold for dashboard utility at pilot scale. + 3. **Signed stateless cookies are secure without TLS in the pilot (R-AUTH-01).** Evidence: RESEARCH-v0.4 §2.4 — config-driven `PRAXIS_COOKIE_SECURE`, defense-in-depth (cohort dashboard reads only k-anonymized aggregates). **Confidence: 0.65** — this is the *signature question* (see probe #1 below). The config-driven flag is a punt; the real mitigation is the k-anon defense-in-depth. + - Confidence: 0.72 + - Decision: **G-025** — 3 core assumptions: Postgres contention (0.75, unmeasured disk I/O), k-anon sufficiency (0.70, privacy-correct but value-destroying at pilot scale), cookie-without-TLS (0.65, config-driven punt with k-anon defense-in-depth). All accepted as pilot-scale constraints. (0.72) + +- **Q2: Dependencies outside the team?** + - Evidence: config.json:13 — full autonomy; PROJECT.md:5. + - Answer: None. Single project, full autonomy. No external departments, vendors, regulators, or customers. The only "external" dependency is the Proxmox cluster (v0.2 deployment) + Ollama Cloud + Deepgram + Cartesia (voice services) — all carried forward from v0.1-v0.2. + - Confidence: 0.90 + - Decision: **G-026** — no external dependencies (full autonomy). Accept. (0.90) + +- **Q3: Single risk that kills v0.4? (R-VC-MIG-01 — losing the v0.3 public key breaks all issued VCs. Mitigation: archive before activate. Is this enough?)** + - Evidence: RESEARCH-v0.4 R-VC-MIG-01 (high severity, 0.85 confidence); PLAN-v0.4 SLICE-04 TASK-04-03 (migration script archives v0.3 public key BEFORE activating new key); TASK-06-05 (e2e test verifies v0.3 VC against Postgres store). + - Answer: R-VC-MIG-01 is the single project-killing risk. If the v0.3 public key is lost, all v0.3 VCs break. The mitigation is *correct*: archive before activate (TASK-04-03 step 2 before step 3). The e2e test (TASK-06-05) verifies a v0.3 VC against the Postgres store with the archived superseded key. This is the *right* test. The risk is mitigated. + - However, there is a *subtle* gap: the migration script (TASK-04-03) reads the v0.3 public key from SQLite. If the SQLite `issuer_keys` table is empty (e.g., the v0.3 pilot never issued a VC → no key was ever generated), the migration script's behavior is undefined. The script should handle "no v0.3 key exists" gracefully (skip the archive step, just generate a fresh v0.4 key). The plan says "Idempotent: if Postgres already has an active key, skip" but does not say "if SQLite has no active key, skip the archive." + - Confidence: 0.80 + - Challenge: The migration script's behavior when SQLite has no v0.3 active key is unspecified. This is an edge case (the pilot may never have issued a VC), but it is the *first-boot* path for most deployments. + - Decision: **G-027 (MUST)** — TASK-04-03 must explicitly handle the "no v0.3 active key in SQLite" case: if `get_active_signing_key_row()` on SQLite returns None, skip the archive step and only generate the fresh v0.4 keypair. Document this as a first-boot path. The e2e test (TASK-06-05) should include a "no v0.3 key" scenario. (0.80) + +- **Q4: Pre-mortem — "It's 90 days from now and v0.4 failed. Why?"** + - Evidence: RESEARCH-v0.4 risks; PLAN-v0.4 risk matrix. + - Answer: The most likely failure modes (in order): + 1. **SPA fallback broke the voice UI (R-DASH-03/05).** The catch-all route shadowed StaticFiles asset serving. The voice UI loaded but JS/CSS 404'd. The operator dashboard worked but the learner product regressed. This is the *highest-blast-radius* failure — it breaks the v0.1-v0.3 learner surface, not just the v0.4 operator surface. + 2. **Postgres contention degraded the voice loop latency (R-MT-01).** The nightly pg_dump + aggregation job at 03:00 CT caused disk I/O contention that spiked the voice loop latency >600ms. This was not caught because the latency test does not run with Postgres loaded. + 3. **The secure-cookie+no-TLS tension was unresolved (R-AUTH-01).** The config-driven flag was set to `false` for the pilot, the operator cookie was sniffed over HTTP on the vmbr0 bridge, and the grill should have caught that the config flag is a punt, not a fix. + 4. **The k-anon dashboard showed nothing at pilot scale.** The operator logged in, saw "— (<10 learners)" for every cell, and concluded the dashboard was broken. The grill should have caught that the dashboard's validation path is test-seeded data, not pilot traffic. + - Confidence: 0.78 + - Decision: **G-028** — pre-mortem top-4 failure modes: SPA fallback regression (highest blast radius), Postgres contention (unmeasured), R-AUTH-01 punt, k-anon-empty-dashboard. All four are addressed in this grill's binding decisions. (0.78) + +--- + +### Axis 8 — Governance, Decision-Making, and Communication + +- **Q1: Decision-maker when two personas disagree?** + - Evidence: config.json:52-54 — lead-developer is the first persona; PERSONAS.md v0.4 — lead-developer "Coordinates task decomposition... resolves conflicts." + - Answer: lead-developer is the decision-maker. This is the established pattern since v0.1. + - Confidence: 0.85 + - Decision: **G-029** — lead-developer is the conflict resolver. Accept. (0.85) + +- **Q2: Governance cadence?** + - Evidence: ROADMAP.md:19 — pipeline stages SPECIFY → CLARIFY → RESEARCH → PLAN → GRILL → SHIP; config.json:105-108 — per-phase ship. + - Answer: Per-phase ship + verify + grill at P0. This is the established cadence. The grill is the crisis-cadence (this document). + - Confidence: 0.85 + - Decision: **G-030** — governance cadence: per-phase ship + verify + grill. Accept. (0.85) + +- **Q3: What's omitted from status reports? (R-AUTH-01 is the smell)** + - Evidence: RESEARCH-v0.4 §2.4 — R-AUTH-01 resolution documented as "the grill must sign off"; PLAN-v0.4:718 — risk matrix lists R-AUTH-01 with "grill must sign off." + - Answer: The smell is R-AUTH-01. The research *acknowledges* the tension but frames the config-driven flag as a resolution. The v0.3 grill (Axis 4 MUST #2) explicitly rejected this approach: "Do not ship `PRAXIS_COOKIE_SECURE=false` as default — use TLS or loopback-binding." The v0.4 plan ships `PRAXIS_COOKIE_SECURE` defaulting to `true` with `false` for HTTP pilot — which is *option (b)* from the v0.3 grill (accept the pilot risk + document) wrapped in a config flag. The v0.3 grill rejected option (b). The v0.4 plan re-litigates this. + - The *real* mitigation — the one the v0.3 grill did not consider — is the k-anon defense-in-depth: the cohort dashboard reads only k-anonymized aggregates, so even a sniffed cookie leaks no PII. This is the *actual* answer to R-AUTH-01, not the config flag. + - Confidence: 0.70 + - Challenge: The plan's R-AUTH-01 resolution re-litigates a v0.3 grill MUST. The config-driven flag is a punt. The real mitigation (k-anon defense-in-depth) is buried in the research, not elevated. + - Decision: **G-031 (MUST)** — R-AUTH-01 resolution must be reframed: the *primary* mitigation is the k-anon defense-in-depth (cohort dashboard reads only k-anonymized aggregates → sniffed cookie leaks no PII). The config-driven `PRAXIS_COOKIE_SECURE` flag is the *secondary* mitigation (operational convenience for when TLS arrives). The plan must document this ordering explicitly in TASK-03-02 and the GRILL-v0.4 ship notes. The v0.3 grill's "use TLS or loopback-binding" MUST is *not* satisfied — but the k-anon defense-in-depth is a *new* mitigation that the v0.3 grill did not evaluate (the v0.3 cohort dashboard was deferred). This grill accepts the k-anon defense-in-depth as the primary R-AUTH-01 resolution for v0.4, *overriding* the v0.3 grill's MUST #2 for the operator-tier surface only. (0.70) + +- **Q4: Stop-the-project trigger?** + - Evidence: config.json:13 — full autonomy; config.json:15 — `escalation_hooks: ["deploy", "delete_data", "merge_to_main"]`. + - Answer: No human stop trigger (full autonomy). The CI agent can escalate (escalation_hooks) but cannot self-stop. The grill is the stop-the-project mechanism — if the verdict were "Rethink" or "Escalate," the project would stop. This grill's verdict is "Proceed-with-conditions," so the project proceeds. + - Confidence: 0.80 + - Decision: **G-032** — no human stop trigger (full autonomy). The grill is the stop mechanism. This grill = proceed with conditions. (0.80) + +--- + +### Axis 9 — Change, Adoption, and Operational Readiness + +- **Q1: Who will use the cohort dashboard, and what's in it for them?** + - Evidence: D-052 — operator bootstrap is env-provided (not a real user); PROJECT.md:53 — "for training operators"; PERSONAS.md — no operator persona (operators are external to the CI agent). + - Answer: The *first operator* is env-provided (D-052 — `PRAXIS_BOOTSTRAP_OPERATOR_USER/PASS`). There is no real operator user in the pilot. The dashboard is a *capability demonstration*, not a tool for a named user. "What's in it for them" = visibility into cohort progression, but at pilot scale (1 learner) the dashboard shows nothing (k-anon suppresses all cells). The dashboard's value is *architectural* (proving the operator tier works), not *operational* (no operator uses it yet). + - Confidence: 0.65 + - Challenge: The dashboard has no real user at pilot scale. This is a *placeholder deliverable* — the capability exists, but no one uses it. The "we'll train them" answer does not apply (there is no "them"). + - Decision: **G-033** — the cohort dashboard's first user is env-provided (D-052), not a real operator. At pilot scale (1 learner), the dashboard shows no data (k-anon). The dashboard is a *capability demonstration* for v0.5+ (when multi-learner data exists). Document this in the ship notes — v0.4 delivers the operator tier *capability*, not operator *value*. (0.65) + +- **Q2: Is the operations team involved now or handed a finished product?** + - Evidence: PERSONAS.md v0.4 — devops-engineer is active in P1 (docker-compose Postgres + CT bump + backup + bootstrap); PLAN-v0.4 SLICE-02 — devops tasks. + - Answer: devops-engineer is involved in P1 (SLICE-02 — .env.example, CT bump, backup script, bootstrap CLI). This is *good* — the operations surface is built by the operations persona, not handed off. The backup strategy (TASK-02-03) is devops-owned. The bootstrap CLI (SLICE-05) is devops-owned. The operations team is involved *now*. + - Confidence: 0.85 + - Decision: **G-034** — devops-engineer is involved in P1 (operations surface built by operations persona). Accept. (0.85) + +- **Q3: Rollback plan if v0.4 goes wrong?** + - Evidence: PLAN-v0.4 — per-phase ship (v0.1.7, v0.1.8, v0.1.9) + git rollback; config.json:42-43 — branching_strategy: phase. + - Answer: Per-phase git rollback (revert the patch tag). But: + - **P1 rollback (v0.1.7)**: Reverting P1 removes the Postgres service + auth. The VC key migration is *irreversible* — once the v0.3 public key is archived as superseded in Postgres and the fresh v0.4 key is active, reverting to v0.3 SQLite keys requires re-pointing the verification endpoint back to SQLite. The plan's fallback (TASK-06-03 — "if pg_store is None, fall back to PraxisStore path") makes this *possible* (set `PRAXIS_PG_DSN` to empty → server falls back to SQLite). This is a *soft* rollback — the Postgres data persists but is unused. + - **P2 rollback (v0.1.8)**: Reverting P2 removes the aggregation pipeline + dashboard. The SPA fallback catch-all route removal is *clean* (revert the route). The React Router addition is *clean* (revert package.json + App.tsx). The aggregation hook in session_recorder.py is *clean* (revert the chained task). P2 rollback is clean. + - **Postgres data migration is hard to roll back** — but the plan does not migrate data (v0.3 credentials stay in SQLite; v0.4 credentials go to Postgres). The VC key *archival* is irreversible (the v0.3 public key is copied to Postgres as superseded), but this is *additive* — the v0.3 SQLite key still exists. Reverting to v0.3 means ignoring the Postgres copy. + - Confidence: 0.75 + - Decision: **G-035** — rollback is per-phase git revert. P1 rollback is *soft* (set `PRAXIS_PG_DSN` to empty → server falls back to SQLite). P2 rollback is *clean* (revert routes + package.json + session_recorder hook). VC key archival is additive (v0.3 SQLite key persists). Accept. (0.75) + +- **Q4: Has anyone validated the success criteria with the people who will judge v0.4 successful?** + - Evidence: config.json:13 — full autonomy; config.json:28-33 — verification automated. + - Answer: No human judge (full autonomy). The CI agent is the judge. The success criteria = 8/8 REQ-IDs covered + per-slice acceptance criteria + verify stage. This is the established pattern. + - Confidence: 0.80 + - Decision: **G-036** — CI is the judge (full autonomy). Success = 8/8 REQ coverage + acceptance criteria + verify. Accept. (0.80) + +--- + +### Meta — Closing Review + +- **Q1: If you were the auditor, what would you flag?** + - Evidence: all axes above. + - Answer: Three flags: + 1. **R-AUTH-01 re-litigates a v0.3 grill MUST.** The config-driven flag is a punt. The k-anon defense-in-depth is the real mitigation but is not elevated. (G-031) + 2. **The k-anon dashboard shows nothing at pilot scale.** The dashboard's validation path is test-seeded data, not pilot traffic. This is a placeholder deliverable. (G-033) + 3. **Backup verification is a hidden requirement.** A nightly pg_dump that is never restored is theater. (G-008) + - Confidence: 0.78 + - Decision: **G-037** — auditor flags: R-AUTH-01 re-litigation, k-anon-empty-dashboard, backup-verification gap. All addressed in binding decisions. (0.78) + +- **Q2: What is v0.4 NOT doing that it should?** + - Evidence: PLAN-v0.4 open questions (742-754); RESEARCH-v0.4. + - Answer: + 1. **Backup restore drill** — not tasked (G-008). + 2. **Latency test with Postgres loaded** — the voice loop latency test (TASK-06-04) checks that Postgres presence doesn't destabilize the learner service, but it does not run the voice loop *under load* with Postgres running the nightly job. The R-MT-01 disk I/O contention is unmeasured. + 3. **Operator deactivation** — no CLI to set `is_active=false`. Minor (SQL workaround), but a gap in the operator lifecycle. + 4. **Differencing-attack test for k-anon** — the v0.3 grill (Axis 7 FIX #2) asked for a differencing-attack test. The v0.4 plan (TASK-07-05) tests k-anon threshold (9 vs 10) but does NOT test that two adjacent 7-day windows cannot re-identify a single learner. This is a v0.3 grill FIX that is not explicitly carried forward. + - Confidence: 0.75 + - Decision: **G-038 (MUST)** — Add a differencing-attack test to TASK-07-05 or TASK-10-03: seed 10 learners in window A, 9 in window B (1 dropped), verify the API does not allow a query that isolates the dropped learner. This is a v0.3 grill FIX (Axis 7 #2) that must be carried forward. (0.75) + +- **Q3: Simplest possible v0.4 that delivers 80% of the value?** + - Evidence: D-053 — 3 dashboard views; PLAN-v0.4 SLICE-08, SLICE-09. + - Answer: The simplest v0.4 = auth + Postgres + *single* dashboard view (practice volume only) + VC key migration. The mastery-progression and failure-patterns views are +20% value but +30% effort (2 more endpoints + 2 more React components + 2 more aggregation metrics). However: D-053 is a CLARIFY decision (0.80 confidence) that names 3 views — cutting to 1 would re-litigate a settled decision. The 3 views are not over-scoped *relative to the decision*. The simpler answer is: v0.4 is already the simplest version (8 REQs, no RBAC, no DP, no learner auth, single operator). Cutting further would break the v0.3 grill's deferred obligation. + - Confidence: 0.75 + - Decision: **G-039** — v0.4 is already the simplest version (8 REQs, single operator role, k-anon not DP). The 3-view dashboard is D-053 (settled). Further cuts would break the v0.3 grill obligation. Accept the scope. (0.75) + +- **Q4: What would have to be true for v0.4 to succeed in the next 90 days, and is it true today?** + - Evidence: all axes. + - Answer: For v0.4 to succeed: + 1. **The SPA fallback must not break the voice UI.** Is it true today? No — it is untested (TASK-10-04 is the test). Will be true after P2. + 2. **The VC key migration must preserve v0.3 VC verification.** Is it true today? No — it is untested (TASK-06-05 is the test). Will be true after P1. + 3. **Postgres must not destabilize the learner service.** Is it true today? Partially — the memory math is sound (6GB CT), but disk I/O contention is unmeasured. Will be true after P1 (with the 03:00 CT mitigation). + 4. **The auth stack must be secure enough for a pilot.** Is it true today? Partially — R-AUTH-01 is a punt with k-anon defense-in-depth. Will be true after G-031 reframes the mitigation. + 5. **The dashboard must show *something* useful.** Is it true today? No — at pilot scale (1 learner), k-anon suppresses everything. Will be true only with test-seeded data (≥10 mock learners). + - Confidence: 0.72 + - Decision: **G-040** — 5 success conditions: SPA fallback (untested), VC migration (untested), Postgres stability (partially), auth security (partially, G-031), dashboard utility (only with test-seeded data). All addressable in P1/P2. Accept with binding decisions. (0.72) + +--- + +### v0.4-Specific Probes (Signature Questions) + +#### Probe 1 — R-AUTH-01 (Secure cookie + no-TLS): Resolution + +**Question:** D-030 said no Traefik/TLS for the pilot. D-041 requires `Secure` cookie attribute. `Secure` requires HTTPS. The research proposes `PRAXIS_COOKIE_SECURE` config-driven (default true, false for HTTP pilot). Is this a real resolution or a punt? What's the actual risk of running auth over HTTP in the LXC pilot? Is the cohort dashboard worth a TLS regression? + +**Evidence:** +- D-030 (PROJECT.md:160) — "vmbr0 DHCP only (pilot, no vmbr1, no Traefik proxy)." +- D-041 (PROJECT.md:171) — "Cookie: httpOnly, secure, SameSite=Strict, 8h expiry." +- RESEARCH-v0.4 §2.4 — config-driven flag, "cohort dashboard reads only k-anonymized aggregates → even a cookie sniffed over HTTP leaks no PII." +- GRILL-v0.3.md Axis 4 MUST #2 — "Do not ship `PRAXIS_COOKIE_SECURE=false` as default — use TLS or loopback-binding." +- server/__main__.py:46 — `HOST = _env("PRAXIS_HOST", "0.0.0.0")` (binds to all interfaces). + +**Analysis:** +The v0.3 grill explicitly rejected shipping `PRAXIS_COOKIE_SECURE=false` as a default. The v0.4 plan ships `PRAXIS_COOKIE_SECURE` defaulting to `true` with `false` for HTTP pilot — which is *option (b)* from the v0.3 grill (accept the pilot risk + document) wrapped in a config flag. This *re-litigates* the v0.3 grill MUST. + +However, the v0.3 grill evaluated R-AUTH-01 *before* the cohort dashboard was scoped. The v0.3 grill's concern was "a cleartext cookie on a shared bridge is a MUST-FIX" — but the v0.3 grill did not know that the cohort dashboard would read *only k-anonymized aggregates*. The v0.4 research introduces a *new* mitigation: **the k-anon defense-in-depth**. A sniffed cookie gives the attacker access to `/api/operator/*`, which returns only k-anonymized cohort data (no PII) + the VC issuance log (credentials are public per D-043). The *worst* an attacker can do with a sniffed operator cookie is: +- Read k-anonymized cohort aggregates (no PII — D-034). +- Read the VC issuance log (credentials are public — D-043). +- Revoke a VC (POST `/api/operator/credentials/{id}/revoke`) — this is a *denial-of-service* on a credential, but the credential is formative (v0.3 grill Axis 4 MUST #1) and the revocation is reversible (operator can re-issue). + +The *actual* risk of running auth over HTTP in the LXC pilot is: an attacker on the vmbr0 bridge can sniff the operator cookie and revoke a formative credential. This is a *low-severity* risk for a pilot. The v0.3 grill's "MUST-FIX" was correct *for a high-stakes credential* — but the v0.3 grill itself downgraded the credential to formative (MUST #1), which *also* downgrades the R-AUTH-01 severity. + +**Resolution:** +The config-driven `PRAXIS_COOKIE_SECURE` flag is a *punt* — it does not fix the underlying tension. The *real* resolution is the k-anon defense-in-depth + the formative credential tier. The v0.3 grill's MUST #2 ("use TLS or loopback-binding") is *overridden* for the v0.4 operator-tier surface because: +1. The cohort dashboard reads only k-anonymized aggregates (no PII leak from a sniffed cookie). +2. The VC credential is formative (low-stakes — revocation is a reversible DoS, not a forgery). +3. The pilot binds to vmbr0 DHCP (shared bridge) — but the pilot has 1 learner and 1 env-provided operator. The attack surface is theoretical. + +**Binding Decision G-031 (MUST)** — R-AUTH-01 resolution: the *primary* mitigation is the k-anon defense-in-depth (sniffed cookie → no PII). The config-driven flag is *secondary* (operational convenience). The plan must document this ordering. The v0.3 grill's MUST #2 is overridden for v0.4 *only* because the v0.3 grill's own formative-credential decision (MUST #1) downgraded the R-AUTH-01 severity. This is a *consistent* override — the v0.3 grill's two MUSTs interact, and the formative tier + k-anon defense-in-depth together resolve the tension that either alone does not. + +**Confidence: 0.70** — the resolution is sound but re-litigates a prior grill MUST. The override is justified by the *interaction* of two v0.3 grill decisions (formative tier + k-anon), not by a single new fact. + +--- + +#### Probe 2 — R-VC-MIG-01 (VC key migration): Is "archive before activate" enough? + +**Question:** v0.3 issued VCs are in the field (hypothetically). v0.4 migrates the issuer key to Postgres. If the v0.3 public key is lost, all v0.3 VCs break. The plan says "archive before activate." Is that enough? Is there a test that verifies a v0.3 VC against the archived key after migration? + +**Evidence:** +- PLAN-v0.4 TASK-04-03 — migration script: step 2 (archive v0.3 public key as superseded) BEFORE step 3 (generate fresh v0.4 key). +- PLAN-v0.4 TASK-06-05 — e2e test: "v0.3 VC verifies against Postgres store with archived superseded key (R-VC-MIG-01 explicitly verified)." +- server/vc/issuer_keys.py:102-109 — `get_public_key_for_verification` queries by `key_id` (not status) — the fallback to superseded keys is implicit. +- RESEARCH-v0.4 §5.3 — "No code change needed in the verification flow — only the store backing changes." + +**Analysis:** +"Archive before activate" is the *correct* ordering — if the migration fails between step 2 and step 3, the v0.3 key is archived but no v0.4 key is active. The verification endpoint would find the v0.3 key (superseded) and verify v0.3 VCs. New VCs cannot be issued (no active key) until the migration is re-run. This is a *safe failure mode*. + +The e2e test (TASK-06-05) is thorough: it seeds a v0.3 VC, runs the migration, verifies the v0.3 VC against the Postgres store, issues a v0.4 VC, verifies it, tampers with the v0.3 VC (verification fails), and re-runs the migration (idempotent). This covers R-VC-MIG-01. + +**Gap (G-027):** The migration script's behavior when SQLite has *no* v0.3 active key (the pilot never issued a VC) is unspecified. This is the *first-boot* path for most deployments. Must be handled. + +**Verdict:** "Archive before activate" is enough *with* the e2e test (TASK-06-05) as the proof. The gap (no v0.3 key) is a binding decision (G-027). **Confidence: 0.80.** + +--- + +#### Probe 3 — k-anonymity at pilot scale: Dashboard that shows nothing? + +**Question:** v0.1-v0.3 used `HARDCODED_LEARNER_ID = "learner-1"` — a single learner. k-anonymity ≥ 10 will suppress EVERY cell in the cohort dashboard. The dashboard will show "— (<10 learners)" for everything. Is v0.4 building a dashboard that can't show any data until there are 10+ learners? Is that a real deliverable or a placeholder? What test data seeds ≥10 mock learners? + +**Evidence:** +- db/store.py:29 — `HARDCODED_LEARNER_ID = "learner-1"` (confirmed — single learner). +- D-034 (PROJECT.md:164) — "k-anonymity ≥ 10." +- REQ-NFR-DASH-01 — "cells with < 10 learners are suppressed." +- PLAN-v0.4 Open Question #3 (line 746) — "For v0.4 (single learner), k-anonymity will suppress everything (1 < 10). This is expected at pilot scale (R-DASH-01). The executor should seed test data with ≥10 mock learners to verify the non-suppressed path." +- PLAN-v0.4 TASK-10-03 — P2 integration test seeds 15 mock sessions (12 distinct learners) for the non-suppressed path + 5 sessions (5 learners) for the suppressed path. + +**Analysis:** +At pilot scale (1 learner), the dashboard shows "— (<10 learners)" for every cell. This is *privacy-correct* (k-anon is working) but *value-destroying* (the dashboard is useless). The plan acknowledges this (Open Question #3) and the validation path is *test-seeded data* (TASK-10-03 seeds 12 + 5 mock learners). The dashboard is a *capability demonstration*, not an operational tool — at pilot scale, no operator uses it (G-033). + +This is a *real deliverable* in the sense that the *capability* exists (Postgres + aggregation + k-anon + auth + UI), but it is a *placeholder* in the sense that it cannot show real data until multi-learner-per-device is implemented (deferred). The v0.4 milestone delivers the *plumbing*, not the *value*. + +**Verdict:** The dashboard is a placeholder deliverable at pilot scale. The validation path is test-seeded data (TASK-10-03), not pilot traffic. This must be documented in the ship notes (G-033). The k-anon suppression is *correct behavior* — the dashboard is working as designed. The issue is that the design is correct for a *cohort* but the pilot has *one learner*. **Confidence: 0.75.** + +--- + +#### Probe 4 — Postgres-in-LXC resource contention (R-MT-01): Voice loop latency? + +**Question:** Adding Postgres to the LXC CT bumps memory 4GB→6GB. The learner-facing voice loop has a <600ms latency budget (C-8). Will Postgres idle I/O + the aggregation pipeline degrade the voice loop? Is there a latency test that runs with Postgres loaded? + +**Evidence:** +- RESEARCH-v0.4 §1.1 — Postgres idle ~400MB, praxis ~500MB, 6GB CT has ~50% margin. "Postgres queries are off the voice path (operator endpoints + nightly aggregation only)." +- R-MT-01 — "disk I/O contention during nightly pg_dump + aggregation." Mitigation: 03:00 CT. +- PLAN-v0.4 TASK-06-04 — "Test that learner voice loop (`/health`, `/pipecat/webrtc`) is unaffected by auth (REQ-NFR-MT-01 — Postgres + learner service coexist)." +- C-8 — latency budget < 600ms. + +**Analysis:** +The memory math is sound (6GB CT, ~1.3GB runtime, ~4.7GB headroom). The *voice loop* (WebRTC → Pipecat → ASR → LLM → TTS) does not touch Postgres — it uses SQLite for learner state (D-007 preserved) and the voice services (Deepgram, Cartesia, Ollama Cloud). Postgres is used only by operator endpoints + nightly aggregation. The *risk* is disk I/O contention during the nightly pg_dump + aggregation job (03:00 CT). + +TASK-06-04 tests that Postgres presence doesn't destabilize the learner service — but it tests *coexistence* (health check passes, WebRTC offer accepted), not *latency under load*. The plan does NOT include a latency test that runs the voice loop *while Postgres is executing the nightly job*. The R-MT-01 mitigation (03:00 CT scheduling) is a *scheduling* assumption, not a *measurement*. + +**Verdict:** The memory contention is well-mitigated (6GB CT). The disk I/O contention is *unmeasured* — the 03:00 CT mitigation is reasonable (low learner activity) but not proven. The voice loop does not touch Postgres, so the *path* is clean — the risk is *system-level* I/O contention, not *application-level* query contention. **Confidence: 0.70** — the risk is low (Postgres is off the voice path) but unmeasured. Accept the 03:00 CT mitigation as a pilot-scale constraint. + +--- + +#### Probe 5 — SPA fallback breaking voice UI (R-DASH-03/05): Route ordering? + +**Question:** Adding a catch-all route for React Router `/operator/*` must not break the voice UI at `/`. The catch-all must be registered BEFORE StaticFiles but AFTER API routes. Is this ordering tested? What's the rollback if the voice UI breaks? + +**Evidence:** +- server/__main__.py:146 — `app.mount("/", StaticFiles(directory=_CLIENT_DIST, html=True))` (current — no SPA fallback). +- PLAN-v0.4 TASK-10-01 — catch-all route `@app.get("/{path:path}")` BEFORE StaticFiles. +- PLAN-v0.4 TASK-10-04 — 8-assertion test (voice UI at `/`, SPA fallback for `/operator/*`, API routes return JSON, assets served by StaticFiles). +- R-DASH-03 — "SPA fallback breaks existing voice UI (StaticFiles mount change)." + +**Analysis:** +The catch-all route `@app.get("/{path:path}")` is a *greedy* match — it matches *every* path. If registered before StaticFiles, it will intercept all GET requests, including `/assets/index.js`. The plan's TASK-10-01 says "the catch-all only serves index.html for client-side routes" but a `@app.get("/{path:path}")` route does not distinguish between client-side routes and static assets — it matches both. The *correct* implementation is either: +1. A custom StaticFiles subclass that returns index.html for non-file paths (the plan's Open Question #2, line 744). +2. A catch-all that excludes static asset paths (e.g., check if the path matches a file in `client/dist` first). + +TASK-10-04 assertion 8 (`GET /assets/index.js` → served by StaticFiles, not the catch-all) is the *test* for this, but the *implementation* in TASK-10-01 is ambiguous. If the catch-all is registered before StaticFiles, FastAPI route matching order means the catch-all *wins* — StaticFiles never serves `/assets/index.js`. The plan's assertion 8 would *fail*. + +**The correct ordering is: API routes → StaticFiles mount → catch-all (for SPA fallback).** But FastAPI's `app.mount("/", StaticFiles(...))` *is* a catch-all at `/` — adding another catch-all after it is redundant (StaticFiles with `html=True` already serves index.html for `/`). The *real* fix is a custom StaticFiles subclass that returns index.html for non-file paths (Open Question #2). + +**Verdict:** The plan's TASK-10-01 catch-all approach is *subtly wrong* — a `@app.get("/{path:path}")` before StaticFiles would shadow asset serving. The correct approach is a custom StaticFiles subclass (Open Question #2) OR a catch-all *after* StaticFiles that only fires for 404s. The plan defers this to EXECUTE (Open Question #2) but the test (TASK-10-04 assertion 8) would catch the bug. **Confidence: 0.65** — the test is correct, the implementation is ambiguous. This is a binding decision. + +**Binding Decision G-041 (MUST)** — TASK-10-01 must NOT use a `@app.get("/{path:path}")` catch-all before StaticFiles (it would shadow asset serving per assertion 8). The correct implementation is a custom StaticFiles subclass that returns `FileResponse("client/dist/index.html")` for non-file paths (Open Question #2 resolved in favor of the subclass approach). The catch-all approach is rejected. This must be documented in TASK-10-01 before EXECUTE. (0.65) + +--- + +#### Probe 6 — 2-phase split: REQ-MT-02 spans P1 (schema) + P2 (pipeline). Vertical-slice violation? + +**Question:** P1 (foundation) + P2 (dashboard) — is the split clean? REQ-MT-02 (aggregation) spans both phases (schema in P1, pipeline in P2). Is that a vertical-slice violation, or a clean layering? + +**Evidence:** +- PLAN-v0.4:18-19 — P1 covers "REQ-MT-02 (schema foundation)"; P2 covers "REQ-MT-02 (pipeline completion)." +- PLAN-v0.4 REQ-ID coverage matrix (line 699) — REQ-MT-02: SLICE-01 (schema), SLICE-07 (pipeline), SLICE-10 (e2e). + +**Analysis:** +REQ-MT-02 is split across P1 (schema — the `cohort_aggregates` table) and P2 (pipeline — the aggregation hook + nightly job). This is *not* a vertical-slice violation — it is *clean layering*. The schema is the *contract*; the pipeline is the *implementation*. P1 ships the schema (the table exists, the PgStore has `upsert_cohort_aggregate`), P2 ships the pipeline (the hook fires, the nightly job runs). The P1→P2 dependency is *one-directional* (P2 depends on P1's schema, P1 does not depend on P2's pipeline). + +This is the same pattern as v0.3 (mastery schema in P1, mastery flow in P1 — but the VC issuer was split, which the v0.3 grill flagged as a MUST). The difference is that REQ-MT-02's split is *schema vs. pipeline* (a clean layer), not *trigger vs. action* (the v0.3 grill's VC-issuance wiring gap). The aggregation pipeline does not need a P1 trigger — it fires on session-end, which is a P2 event (the hook is in `session_recorder.py`, which is extended in P2). + +**Verdict:** The REQ-MT-02 split is clean layering (schema in P1, pipeline in P2), not a vertical-slice violation. The P1→P2 dependency is one-directional. The v0.3 grill's VC-issuance wiring gap (trigger in P1, action in P2) does not apply here — the aggregation trigger (session-end) is in P2. **Confidence: 0.85.** + +--- + +### v0.3 Grill Deferred Items — Coverage Check + +The v0.3 grill (GRILL-v0.3.md) deferred the operator tier to v0.4. The v0.3 grill's MUST conditions were resolved *in v0.3* (formative label, scoring_inconclusive, VC interop, key rotation, VC-issuance wiring). Let me verify the v0.3 grill's deferred items are now covered in v0.4: + +| v0.3 Grill Deferred Item | v0.4 Coverage | Status | +|---------------------------|---------------|--------| +| REQ-DASH-01 (cohort dashboard) | REQ-DASH-01 activated, PLAN SLICE-08/09/10 | ✅ Covered | +| REQ-AUTH-01 (operator auth) | REQ-AUTH-01 activated, PLAN SLICE-03/05/06 | ✅ Covered | +| REQ-MT-01 (operator Postgres) | REQ-MT-01 activated, PLAN SLICE-01/06 | ✅ Covered | +| REQ-MT-02 (aggregation) | REQ-MT-02 activated, PLAN SLICE-01/07/10 | ✅ Covered | +| REQ-NFR-AUTH-01 (auth NFRs) | REQ-NFR-AUTH-01 activated, PLAN SLICE-03/06 | ✅ Covered | +| REQ-NFR-MT-01 (Postgres-in-LXC) | REQ-NFR-MT-01 activated, PLAN SLICE-01/02/06 | ✅ Covered | +| REQ-NFR-DASH-01 (k-anon ≥10) | REQ-NFR-DASH-01 activated, PLAN SLICE-07/08/09/10 | ✅ Covered | +| REQ-NFR-DASH-02 (freshness ≤24h) | REQ-NFR-DASH-02 activated, PLAN SLICE-07/10 | ✅ Covered | + +**v0.3 grill FIX conditions carried forward to v0.4:** + +| v0.3 Grill FIX | v0.4 Coverage | Status | +|----------------|---------------|--------| +| Axis 7 #2 — k-anon differencing-attack test | NOT explicitly in PLAN (TASK-07-05 tests threshold only) | ⚠️ G-038 (MUST) — add differencing-attack test | +| Axis 6 #3 — 503 guard on operator API when Postgres down | TASK-06-01 — "auth routes return 503" if no Postgres | ✅ Covered | +| Axis 6 #2 — stabilize learner_ref as non-reusable UUID | NOT addressed in v0.4 (HARDCODED_LEARNER_ID = "learner-1" persists) | ⚠️ Accepted as pilot-scale constraint (G-012) | + +**Verdict:** 8/8 v0.3 deferred REQs are covered in v0.4. 1 v0.3 FIX (differencing-attack test) is not carried forward and must be added (G-038). The learner_ref stabilization (v0.3 FIX) is accepted as a pilot-scale constraint (single hardcoded learner persists). + +--- + +### Binding Decisions + +| ID | Axis | Decision | Confidence | Type | +|----|------|----------|-----------|------| +| G-001 | 1 | v0.4 operator tier is the correct next priority (delivers v0.3 grill's deferred obligation) | 0.85 | ACCEPT | +| G-002 | 1 | CI is the named sponsor under full autonomy | 0.80 | ACCEPT | +| G-003 | 1 | v0.4 is not a zombie; pilot-scale business value is low (k-anon suppresses all cells). Dashboard validation path = test-seeded data. Document in ship notes. | 0.75 | ACCEPT | +| G-004 | 1 | No financial ROI; ROI is governance credibility + architectural foundation. Accept non-financial ROI. | 0.65 | ACCEPT | +| G-005 | 2 | v0.4 scope is a clean handoff from v0.3 grill deferral. No scope creep. | 0.90 | ACCEPT | +| G-006 | 2 | Requirements frozen (8 REQs, CI-owned under full autonomy) | 0.85 | ACCEPT | +| G-007 | 2 | Out-of-scope is explicit and comprehensive | 0.88 | ACCEPT | +| **G-008** | **2** | **MUST: Add backup-restore drill task to P1 — execute pg_restore, verify 5 tables + row counts. A backup that is never restored is theater.** | **0.70** | **MUST** | +| G-009 | 3 | Architecture is conventional (standard FastAPI + Postgres + React patterns), research-validated | 0.80 | ACCEPT | +| G-010 | 3 | 4 new deps, all single-purpose. slowapi fallback documented. Accept. | 0.78 | ACCEPT | +| **G-011** | **3** | **MUST: Verification endpoint two-store fallback semantics must be explicit in TASK-04-04 + TASK-06-03 (not deferred to EXECUTE). Rule: Postgres for keys → SQLite fallback for v0.3 credentials → SQLite-only if no Postgres.** | **0.75** | **MUST** | +| G-012 | 3 | Three inherited debts acknowledged (SQLite VC keys, single learner, no TLS). Debts #2 and #3 accepted as pilot-scale constraints. | 0.72 | ACCEPT | +| G-013 | 4 | Key-person dependency: security-engineer, data-engineer, backend-engineer. Accept under parallelization. | 0.82 | ACCEPT | +| G-014 | 4 | 6 personas available (4 config + 2 emergent), max 5 concurrent. 6>5 not binding. | 0.80 | ACCEPT | +| G-015 | 4 | CI is the product owner with full authority | 0.85 | ACCEPT | +| G-016 | 4 | Team building new capability (Postgres, auth, k-anon, React Router) — conventional patterns, thorough research. Accept for pilot. | 0.75 | ACCEPT | +| G-017 | 5 | Phase structure set after scope understood. Not reverse-engineered. | 0.85 | ACCEPT | +| G-018 | 5 | Critical-path risk: SPA fallback (R-DASH-03). Mitigation: TASK-10-04. Accept with test as gate. | 0.75 | ACCEPT | +| G-019 | 5 | 52 tasks is evidence-based (analogous to v0.3's 40, bottom-up sized) | 0.80 | ACCEPT | +| G-020 | 5 | Definition of done = per-slice acceptance criteria + per-phase ship + verify | 0.85 | ACCEPT | +| G-021 | 6 | No explicit token budget (pilot, full autonomy). Accept implicit budget model. | 0.75 | ACCEPT | +| G-022 | 6 | Cost drivers budgeted (6GB CT, backup volume). Image + backup storage negligible. | 0.85 | ACCEPT | +| G-023 | 6 | Burn rate: ~1.3 days estimated (analogous to v0.3) | 0.75 | ACCEPT | +| G-024 | 6 | No budget contingency (full autonomy) | 0.90 | ACCEPT | +| G-025 | 7 | 3 core assumptions: Postgres contention (0.75), k-anon sufficiency (0.70), cookie-without-TLS (0.65). All accepted as pilot-scale constraints. | 0.72 | ACCEPT | +| G-026 | 7 | No external dependencies (full autonomy) | 0.90 | ACCEPT | +| **G-027** | **7** | **MUST: TASK-04-03 must handle "no v0.3 active key in SQLite" — skip archive, generate fresh v0.4 key only. First-boot path for most deployments.** | **0.80** | **MUST** | +| G-028 | 7 | Pre-mortem top-4: SPA fallback, Postgres contention, R-AUTH-01 punt, k-anon-empty-dashboard. All addressed. | 0.78 | ACCEPT | +| G-029 | 8 | lead-developer is the conflict resolver | 0.85 | ACCEPT | +| G-030 | 8 | Governance cadence: per-phase ship + verify + grill | 0.85 | ACCEPT | +| **G-031** | **8** | **MUST: R-AUTH-01 resolution reframed — primary mitigation = k-anon defense-in-depth (sniffed cookie → no PII). Config-driven flag = secondary. v0.3 grill MUST #2 overridden for v0.4 operator surface because formative tier + k-anon together resolve the tension. Document ordering in TASK-03-02 + ship notes.** | **0.70** | **MUST** | +| G-032 | 8 | No human stop trigger (full autonomy). Grill is the stop mechanism. | 0.80 | ACCEPT | +| G-033 | 9 | Dashboard's first user is env-provided (not real). At pilot scale, shows no data. Capability demonstration for v0.5+. Document in ship notes. | 0.65 | ACCEPT | +| G-034 | 9 | devops-engineer involved in P1 (operations surface built by operations persona) | 0.85 | ACCEPT | +| G-035 | 9 | Rollback is per-phase git revert. P1 = soft (empty DSN → SQLite fallback). P2 = clean. VC key archival = additive. | 0.75 | ACCEPT | +| G-036 | 9 | CI is the judge (full autonomy). Success = 8/8 REQ + acceptance criteria + verify. | 0.80 | ACCEPT | +| G-037 | Meta | Auditor flags: R-AUTH-01 re-litigation, k-anon-empty-dashboard, backup-verification gap. All addressed. | 0.78 | ACCEPT | +| **G-038** | **Meta** | **MUST: Add differencing-attack test to TASK-07-05 or TASK-10-03 — v0.3 grill FIX (Axis 7 #2) carried forward. Seed 10 learners in window A, 9 in B, verify API cannot isolate the dropped learner.** | **0.75** | **MUST** | +| G-039 | Meta | v0.4 is already the simplest version (8 REQs, single operator, k-anon not DP). 3-view dashboard is D-053 (settled). | 0.75 | ACCEPT | +| G-040 | Meta | 5 success conditions: SPA fallback (untested), VC migration (untested), Postgres stability (partial), auth security (partial, G-031), dashboard utility (test-seeded only). All addressable. | 0.72 | ACCEPT | +| **G-041** | **Probe 5** | **MUST: TASK-10-01 must NOT use `@app.get("/{path:path}")` catch-all before StaticFiles (shadows asset serving). Use custom StaticFiles subclass returning index.html for non-file paths. Open Question #2 resolved in favor of subclass.** | **0.65** | **MUST** | + +--- + +### Escalations + +None. All 9 axes + meta + 6 v0.4-specific probes are resolved with confidence ≥ 0.60. The 6 MUST conditions (G-008, G-011, G-027, G-031, G-038, G-041) are binding decisions with clear resolutions — they do not require human escalation (full autonomy). The lowest-confidence binding decision is G-041 (0.65 — SPA fallback implementation) which is above the 0.60 threshold. + +--- + +### MUST Conditions Summary (blocking — must be resolved in PLAN before EXECUTE) + +1. **G-008 — Backup restore drill.** Add a task to P1 that executes `pg_restore --clean --if-exists` against a test Postgres and verifies the 5 tables + row counts. A nightly pg_dump that is never restored is theater. + +2. **G-011 — Verification endpoint two-store fallback semantics.** TASK-04-04 + TASK-06-03 must explicitly document the fallback contract: (a) Postgres available → use it for key lookup (active + superseded); (b) Postgres available but credential not found → fall back to SQLite `issued_credentials` (v0.3 credentials); (c) Postgres NOT available (no DSN) → use existing v0.3 SQLite path for both keys + credentials. This is a binding contract, not an open question. + +3. **G-027 — VC migration "no v0.3 key" edge case.** TASK-04-03 must handle the case where SQLite has no active issuer key (the pilot never issued a VC): skip the archive step, generate only the fresh v0.4 keypair. The e2e test (TASK-06-05) must include a "no v0.3 key" scenario. This is the first-boot path for most deployments. + +4. **G-031 — R-AUTH-01 resolution reframed.** The *primary* mitigation for R-AUTH-01 is the k-anon defense-in-depth (cohort dashboard reads only k-anonymized aggregates → sniffed cookie leaks no PII). The config-driven `PRAXIS_COOKIE_SECURE` flag is *secondary* (operational convenience). The v0.3 grill's MUST #2 ("use TLS or loopback-binding") is *overridden* for the v0.4 operator-tier surface because the v0.3 grill's own formative-credential decision (MUST #1) + the k-anon defense-in-depth together resolve the tension. Document this ordering in TASK-03-02 and the v0.4 ship notes. + +5. **G-038 — Differencing-attack test.** Add a test to TASK-07-05 or TASK-10-03: seed 10 learners in window A, 9 in window B (1 dropped), verify the API does not allow a query that isolates the dropped learner. This is a v0.3 grill FIX (Axis 7 #2) that must be carried forward. + +6. **G-041 — SPA fallback implementation.** TASK-10-01 must NOT use a `@app.get("/{path:path}")` catch-all before StaticFiles (it would shadow asset serving — TASK-10-04 assertion 8 would fail). The correct implementation is a custom StaticFiles subclass that returns `FileResponse("client/dist/index.html")` for non-file paths. Open Question #2 is resolved in favor of the subclass approach. + +--- + +### FIX Conditions (non-blocking — tracked in VERIFY-P1/P2) + +- **G-003** — Document in v0.4 ship notes: dashboard validation path is test-seeded data (≥10 mock learners), not pilot traffic. At pilot scale (1 learner), k-anon suppresses all cells. +- **G-012** — Document inherited debts: single hardcoded learner (k-anon suppresses pilot data), no TLS (R-AUTH-01 config-driven punt with k-anon defense-in-depth). +- **G-018** — SPA fallback (R-DASH-03) is the critical-path risk. TASK-10-04 (8 assertions) is the gate. If assertion 8 fails, the fix is the custom StaticFiles subclass (G-041). +- **G-025** — Postgres disk I/O contention (R-MT-01) is unmeasured. The 03:00 CT mitigation is a scheduling assumption. Accept as pilot-scale constraint. +- **G-033** — Document in ship notes: v0.4 delivers the operator tier *capability*, not operator *value* (no real operator user at pilot scale). + +--- + +### ACCEPT Items (proceed as-is) + +- v0.4 scope is a clean handoff from v0.3 grill (G-005). +- Architecture is conventional (G-009). +- 4 new deps are single-purpose (G-010). +- Key-person dependency is manageable under parallelization (G-013). +- Phase structure is not reverse-engineered (G-017). +- 52 tasks is evidence-based (G-019). +- No external dependencies (G-026). +- Rollback is per-phase git revert (G-035). +- REQ-MT-02 split (schema in P1, pipeline in P2) is clean layering, not a vertical-slice violation (Probe 6). +- R-VC-MIG-01 "archive before activate" + e2e test is sufficient (Probe 2, with G-027 edge case). + +--- + +### Bottom Line + +The v0.4 plan is **not unfeasible** — the research is thorough, the architecture is conventional, the phase split is clean, and the v0.3 grill's deferred obligation is honestly delivered. The plan is **not over-scoped** (8 REQs, single operator role, k-anon not DP). The plan is **not under-tested** in its highest-risk areas (R-VC-MIG-01 has a dedicated e2e test, R-DASH-03 has 8 assertions). + +The 6 MUST conditions are surgical: +- 2 are *missing tasks* (backup drill, differencing-attack test). +- 2 are *specification clarifications* (verification endpoint fallback, VC migration edge case). +- 1 is a *reframing* (R-AUTH-01: k-anon defense-in-depth is the primary mitigation, not the config flag). +- 1 is an *implementation correction* (SPA fallback: custom StaticFiles subclass, not a catch-all route). + +Resolve the 6 MUSTs, track the 5 FIXs, and v0.4 is a **GO**. \ No newline at end of file diff --git a/.ciagent/PERSONAS.md b/.ciagent/PERSONAS.md index 99a28e2..86671a6 100644 --- a/.ciagent/PERSONAS.md +++ b/.ciagent/PERSONAS.md @@ -322,4 +322,223 @@ territory: [] - frontend-engineer (dashboard UI) ↔ backend-engineer (operator API) ↔ data-engineer (k-anonymity queries) - security-engineer (issuer key) ↔ data-engineer (issuer_keys table, encrypted-at-rest) - The security-engineer is NOT in config.json `personas` — emergent persona defined in PERSONAS.md (same pattern as v0.2 devops-engineer). Territory enforcement (warn mode) picks up globs from PERSONAS.md. -- R-AUTH-01 (Secure cookie + no-TLS) is a security-engineer + lead-developer collaboration point for PLAN. \ No newline at end of file +- R-AUTH-01 (Secure cookie + no-TLS) is a security-engineer + lead-developer collaboration point for PLAN. + +--- + +# Praxis — Persona Assessment (v0.4 Operator Tier) + +> **Generated:** v0.4 RESEARCH stage +> **Project:** Praxis (v0.4 — operator tier: cohort dashboard, auth, Postgres) +> **Source:** v0.4 RESEARCH-v0.4-operator-tier.md + v0.4 REQUIREMENTS.md (REQ-MT-01/02, REQ-AUTH-01, REQ-DASH-01, 4 NFRs) + actual `pyproject.toml` + `client/package.json` + `server/` structure + +## v0.4 Persona Roster + +### Active personas (6) + +The v0.4 milestone is **operator-tier-backend + dashboard-frontend + security-crypto + Postgres-in-LXC**. The frontend-engineer (reactivated in v0.3 anticipatory, now confirmed for v0.4 dashboard UI) and devops-engineer (deactivated in v0.3, reactivated for Postgres-in-LXC + backup + bootstrap script) are both active. The security-engineer is retained (VC key migration SQLite→Postgres + auth stack + Secure-cookie-TLS resolution). The data-engineer expands to the Postgres operator-tier schema + aggregation SQL. All 6 personas are active — the largest roster since v0.1. + +```yaml +--- +name: lead-developer +active: true +phase_specific: false +reason: Coordinates task decomposition across Postgres/auth/cohort/dashboard/VC-migration domains. Resolves conflicts between backend (operator API + aggregation), security (auth + VC key migration), data (Postgres schema + k-anon), frontend (dashboard UI), and devops (Postgres service + CT bump + backup). Owns the docker-compose.yml Postgres service addition (spans data + backend + devops). Required for every milestone. +domain: coordination +frameworks: [pipecat, fastapi, postgres, docker] +constraints: [pragmatic, battle-tested defaults, hybrid-storage-no-cross-db-joins, k-anonymity-floor-10, no-raw-learner-pii-in-postgres, mastery-off-voice-path, aggregation-off-voice-path] +territory: + - "docker-compose.yml" + - ".env.example" +--- +``` + +```yaml +--- +name: backend-engineer +active: true +phase_specific: false +reason: Owns the asyncpg pool wiring (app.state.pg_pool via lifespan — D-050), the operator API routes (server/operator/ — 8 endpoints per D-053/D-057), the cohort aggregation pipeline (server/cohort/ — on-session-end async hook + nightly reconciliation job per D-054), and the session_recorder.py extension to chain the aggregation hook after the mastery flow. Also owns the SPA fallback route in server/__main__.py (required for React Router /operator/* routes). The aggregation pipeline is the largest new backend territory in v0.4. +domain: backend +frameworks: [pipecat, pydantic, fastapi, uvicorn, asyncpg, aiosqlite] +constraints: [api-first, type-safe, mastery-off-voice-path, aggregation-off-voice-path, deterministic-scoring, latency-budget-aware, routes-before-static-mount, no-cross-db-joins, asyncpg-pool-on-app-state] +territory: + - "**/server/**" + - "**/server/operator/**" + - "**/server/cohort/**" + - "**/server/__main__.py" + - "**/session_recorder.py" +--- +``` + +```yaml +--- +name: frontend-engineer +active: true +phase_specific: false +reason: REACTIVATED (confirmed for v0.4 — was anticipatory in v0.3). Owns the React cohort dashboard UI (client/src/operator/ — D-044, REQ-DASH-01, D-053). Auth-gated /operator/* routes + 3 k-anonymized views (practice volume, mastery progression, failure patterns). Adds React Router (react-router-dom@^7 — NEW dep) for /operator/* routing. Renders read-only tables + inline SVG sparklines (zero-dep, ~50 LOC). Auth gate: GET /api/operator/me on mount → redirect to /operator/login if 401. Reuses v0.2 StaticFiles (same client/dist build — D-044). No separate SPA build. +domain: frontend +frameworks: [react, react-router-dom, pipecat-client-sdk, webrtc, vite, fastapi-staticfiles] +constraints: [component-first, auth-gated-operator-routes, k-anonymity-display-suppressed-cells, no-raw-learner-pii-in-ui, spa-fallback-for-operator-routes, inline-svg-sparklines-no-chart-lib] +territory: + - "**/client/**" + - "**/client/src/operator/**" + - "**/client/src/App.tsx" + - "**/client/package.json" +--- +``` + +```yaml +--- +name: data-engineer +active: true +phase_specific: false +reason: EXPANDED territory for v0.4. Owns the Postgres operator-tier schema (operators, issued_credentials, mastery_gate_events, cohort_aggregates, issuer_keys — D-040, refined by D-050..D-053), the db/pg_migrations/ migration runner (mirrors the existing db/migrate.py pattern), the db/pg_store.py (asyncpg-backed Postgres store), the IssuerKeyStore protocol/ABC (D-051 migration — both PraxisStore and PgStore implement it), and the k-anonymity suppression SQL (D-034 — write-time COUNT(DISTINCT learner_ref) >= 10 check). The hybrid SQLite+Postgres storage pattern (D-031) is the data-engineer's architectural concern — no cross-DB joins, opaque learner_ref. The cohort_aggregates table is a plain table (NOT partitioned — v0.4 scale; partitioning deferred post-pilot per RESEARCH-v0.4 §1.7). +domain: data +frameworks: [sqlite, postgres16, aiosqlite, asyncpg, alembic-style-migrations] +constraints: [schema-first, type-safe, migration-driven, no-cross-db-joins, k-anonymity-floor-10, opaque-learner-ref, write-time-suppression, plain-table-no-partitions-v0.4, gen-random-uuid-no-extension] +territory: + - "**/db/**" + - "**/db/migrations/**" + - "**/db/pg_migrations/**" + - "**/db/schema.sql" + - "**/db/pg_schema.sql" + - "**/db/pg_store.py" + - "**/db/pg_migrate.py" +--- +``` + +```yaml +--- +name: security-engineer +active: true +phase_specific: true +reason: RETAINED from v0.3. Owns the VC issuer key migration (D-051 — SQLite→Postgres, v0.3 public key archived as superseded, fresh v0.4 keypair, encrypted at rest) and the operator auth stack (D-041, D-056, D-057 — argon2id passwords, signed stateless cookies via Starlette SessionMiddleware, slowapi 5/min rate limit, server-side auth enforcement on every /api/operator/* request). The Secure-cookie-TLS tension (R-AUTH-01) is the security-engineer's v0.4 collaboration point with lead-developer — resolution is config-driven PRAXIS_COOKIE_SECURE (default true; false for HTTP pilot with logged WARNING). The VC key migration is high-severity risk R-VC-MIG-01 — archiving the v0.3 public key before activating the new key is security-critical. argon2-cffi PasswordHasher defaults (t=3, m=64MiB, p=4) exceed OWASP minimums (verified 2026-08-04). +domain: security +frameworks: [pynacl, canonicaljson, base58, argon2-cffi, starlette-sessionmiddleware, slowapi, itsdangerous] +constraints: [eddsa-jcs-2022-cryptosuite, no-plaintext-keys-in-git, issuer-key-encrypted-at-rest, argon2id-passwords-owasp-minimums, config-driven-secure-cookie, superseded-not-revoked, server-side-auth-enforcement, public-verification-no-pii] +territory: + - "**/server/vc/**" + - "**/server/auth/**" + - "**/vc/**" + - "**/auth/**" +--- +``` + +```yaml +--- +name: devops-engineer +active: true +phase_specific: true +reason: REACTIVATED for v0.4 (was deactivated in v0.3 — no deploy scripts). v0.4 adds Postgres as a second Docker service in the existing LXC CT (D-040), which is devops territory: the docker-compose Postgres service definition + praxis-net bridge network + pgdata/pgbackups named volumes + pg_isready healthcheck + CT memory bump (4GB→6GB) + host-side cron for nightly pg_dump backup (D-055) + the scripts/create-operator.py bootstrap CLI (D-052) + .env.example operator vars (PRAXIS_PG_PASSWORD, PRAXIS_COOKIE_SECRET, PRAXIS_BOOTSTRAP_OPERATOR_USER/PASS, PRAXIS_VC_ISSUER_KEY). The Postgres-in-LXC addition is NOT just a docker-compose service addition (as v0.3 assumed) — it involves CT resource bump (lxc-config.sh memory change), backup cron setup, and the bootstrap script. Will deactivate again in v0.5 unless deploy hardening continues. +domain: devops +frameworks: [proxmox-ve-api, lxc, docker, systemd, bash, bats, gitea, pg_dump, cron] +constraints: [idempotent-deploy, rollback-on-failure, secrets-never-committed, posix-sh-compatible, pg-dump-backup-retention-7d, host-side-cron-decoupled-from-app, ct-memory-bump-6gb] +territory: + - "scripts/proxmox/**" + - "scripts/install-service.sh" + - "scripts/create-operator.py" + - "scripts/proxmox/praxis.service" + - "scripts/proxmox/test/**" + - ".env.example" +--- +``` + +### Deactivated personas (0) + +All 6 personas are active for v0.4. No deactivations. + +### Proposed personas (not v0.4) + +```yaml +--- +name: voice-engineer +active: false +phase_specific: false +reason: PROPOSED for v0.5+ (Live Assist) when latency tuning, accent modeling, and multi-voice personas become central. v0.4 uses Pipecat's built-in voice pipeline (Silero VAD + Deepgram + Cartesia/Piper), so a dedicated voice-engineer is not warranted. +domain: voice +frameworks: [webrtc, silero-vad, audio-codecs] +constraints: [sub-600ms-latency, accent-robustness, audio-quality-vs-latency-tradeoff] +territory: [] +--- +``` + +```yaml +--- +name: ml-engineer +active: false +phase_specific: false +reason: PROPOSED for v0.6+ when fine-tuning Ollama models on Canadian English / role-play data becomes relevant. v0.4 uses off-the-shelf cloud models — no ML training in scope. +domain: ml +frameworks: [ollama, pytorch, axolotl] +constraints: [open-weights, cost-bounded-fine-tuning] +territory: [] +--- +``` + +## Framework Alignment (v0.4 — from actual pyproject.toml + client/package.json) + +| Persona | Frameworks (v0.4 research-aligned) | New in v0.4 | Source | +|---------|-------------------------------------|-------------|--------| +| lead-developer | pipecat, fastapi, postgres, docker | — | `pyproject.toml` + `docker-compose.yml` | +| backend-engineer | pipecat, pydantic, fastapi, uvicorn, asyncpg, aiosqlite | **asyncpg** | `pyproject.toml` | +| frontend-engineer | react, react-router-dom, pipecat-client-sdk, webrtc, vite, fastapi-staticfiles | **react-router-dom** | `client/package.json` | +| data-engineer | sqlite, postgres16, aiosqlite, asyncpg, alembic-style-migrations | **postgres16, asyncpg** | `pyproject.toml` + `db/migrate.py` | +| security-engineer | pynacl, canonicaljson, base58, argon2-cffi, starlette-sessionmiddleware, slowapi, itsdangerous | **argon2-cffi, slowapi** | `pyproject.toml` + RESEARCH-v0.4 | +| devops-engineer | proxmox-ve-api, lxc, docker, systemd, bash, bats, gitea, pg_dump, cron | **pg_dump, cron** | `scripts/proxmox/` + `docker-compose.yml` | + +## Territory Alignment (v0.4 — from actual server/ structure) + +The actual `server/` structure: `asr/`, `tts/`, `llm/`, `guardrails/`, `scenarios/`, `mastery/`, `paths/`, `vc/`, `services/`, `pipeline.py`, `session_recorder.py`, `__main__.py`, `cost.py`, `debrief.py`, `latency.py`, `interruptibility.py`. v0.4 adds: `server/operator/` (operator API), `server/auth/` (auth middleware), `server/cohort/` (aggregation pipeline), `db/pg_store.py`, `db/pg_migrate.py`, `db/pg_migrations/`, `db/pg_schema.sql`, `scripts/create-operator.py`, `client/src/operator/`. + +Key territory boundaries: +- **docker-compose.yml** → lead-developer (spans praxis + postgres services + networks + volumes; collaborates with data + devops) +- **server/__main__.py** (SPA fallback) → backend-engineer (the catch-all route before StaticFiles mount — D-044 SPA fallback) +- **server/operator/** → backend-engineer (operator API routes) +- **server/auth/** → security-engineer (auth middleware, argon2, cookies, rate limit) +- **server/cohort/** → backend-engineer (aggregation pipeline — hook + nightly job) +- **server/vc/issuer_keys.py** → security-engineer (IssuerKeyStore protocol refactor — D-051) +- **db/pg_store.py + db/pg_schema.sql + db/pg_migrations/** → data-engineer (Postgres store + schema + migrations) +- **scripts/create-operator.py** → devops-engineer (operator bootstrap CLI — D-052) +- **scripts/proxmox/** → devops-engineer (CT memory bump if lxc-config.sh changes) +- **client/src/operator/** → frontend-engineer (dashboard UI) +- **client/src/App.tsx** → frontend-engineer (React Router wrapper + SPA fallback integration) +- **client/package.json** → frontend-engineer (react-router-dom addition) +- **.env.example** → devops-engineer (operator vars: PRAXIS_PG_PASSWORD, PRAXIS_COOKIE_SECRET, PRAXIS_BOOTSTRAP_OPERATOR_USER/PASS, PRAXIS_VC_ISSUER_KEY) + +## Constraint Alignment (v0.4-specific) + +- **All personas:** `hybrid-storage-no-cross-db-joins` (D-031), `k-anonymity-floor-10` (D-034), `no-raw-learner-pii-in-postgres` (D-031). +- **lead-developer:** `aggregation-off-voice-path` (D-054 — async fire-and-forget, must not block session-end response). +- **backend-engineer:** `mastery-off-voice-path` (C-8 carry-forward), `aggregation-off-voice-path` (D-054), `asyncpg-pool-on-app-state` (D-050 — pool created in lifespan, not per-request), `routes-before-static-mount` (carry-forward + SPA fallback catch-all before StaticFiles). +- **frontend-engineer:** `auth-gated-operator-routes` (D-057), `k-anonymity-display-suppressed-cells` (D-034 — render "— (<10 learners)" for suppressed cells), `no-raw-learner-pii-in-ui` (D-031), `spa-fallback-for-operator-routes` (new — React Router needs index.html fallback), `inline-svg-sparklines-no-chart-lib` (RESEARCH-v0.4 §4.3 — zero-dep sparklines). +- **data-engineer:** `no-cross-db-joins` (D-031), `opaque-learner-ref` (D-031 — learner_ref is opaque string, not FK), `write-time-suppression` (D-034 — cell suppression at write time, not read time), `plain-table-no-partitions-v0.4` (RESEARCH-v0.4 §1.7 — partitioning deferred post-pilot), `gen-random-uuid-no-extension` (PG16 core, no pgcrypto). +- **security-engineer:** `argon2id-passwords-owasp-minimums` (D-041 + OWASP — PasswordHasher defaults exceed minimums), `config-driven-secure-cookie` (R-AUTH-01 resolution — PRAXIS_COOKIE_SECURE env var), `issuer-key-encrypted-at-rest` (D-042 — nacl.SecretBox with PRAXIS_VC_ISSUER_KEY root key), `superseded-not-revoked` (D-051 — v0.3 public key archived as superseded, not revoked), `server-side-auth-enforcement` (D-057 — server checks cookie on every /api/operator/* request, React guard is UX only), `public-verification-no-pii` (D-043 carry-forward). +- **devops-engineer:** `idempotent-deploy` (carry-forward), `secrets-never-committed` (carry-forward), `pg-dump-backup-retention-7d` (D-055 — %u day-of-week rolling 7-file), `host-side-cron-decoupled-from-app` (RESEARCH-v0.4 §1.5 — backup runs even if praxis is down), `ct-memory-bump-6gb` (REQ-NFR-MT-01 — 4GB→6GB). + +## Phase-Specific Personas + +Two personas are **phase-specific** for v0.4: + +1. **security-engineer** — `phase_specific: true`. Retained from v0.3 (was new in v0.3 for VC crypto). May persist into v0.9 (credentialing) but deactivate in between if no security-crypto work. The VC key migration + auth stack are the v0.4 security-critical surfaces. + +2. **devops-engineer** — `phase_specific: true`. Reactivated from v0.2 (was deactivated in v0.3). v0.4 is Postgres-in-LXC heavy (docker-compose service + CT bump + backup + bootstrap). Will deactivate again in v0.5 unless deploy hardening continues. + +## v0.4 Notes for PLAN/EXECUTE + +- Territory enforcement mode: `warn` (per config.json `personas.territory_enforcement`) +- The **backend-engineer owns the largest v0.4 task surface**: asyncpg pool + operator API (8 endpoints) + aggregation pipeline (hook + nightly job) + session_recorder extension + SPA fallback. This is the largest backend surface since v0.3. +- The **frontend-engineer reactivates for confirmed dashboard work** (v0.3 was anticipatory; v0.4 is the real dashboard implementation). React Router addition + SPA fallback + 3 k-anonymized views + inline SVG sparklines. +- The **security-engineer's v0.4 surface is high-severity**: VC key migration (R-VC-MIG-01 — archiving v0.3 public key is security-critical) + auth stack (R-AUTH-01 — Secure cookie + no-TLS resolution). +- The **data-engineer's v0.4 surface spans two stores** (SQLite v0.3 + Postgres v0.4) + the IssuerKeyStore protocol (D-051 migration bridge). +- The **devops-engineer's v0.4 surface is smaller than v0.2** but critical: docker-compose Postgres service + CT memory bump + backup cron + bootstrap script. +- Cross-persona collaboration points: + - backend-engineer (aggregation hook in session_recorder) ↔ data-engineer (cohort_aggregates schema + suppression SQL) ↔ security-engineer (learner_ref is opaque, no PII) + - frontend-engineer (dashboard UI) ↔ backend-engineer (operator API endpoints) ↔ data-engineer (k-anonymity queries) + - security-engineer (IssuerKeyStore protocol) ↔ data-engineer (PgStore implements it) — D-051 migration + - security-engineer (auth middleware) ↔ backend-engineer (operator API router dependencies) — D-057 + - devops-engineer (docker-compose Postgres) ↔ lead-developer (compose file owner) ↔ data-engineer (pgdata volume + schema) + - devops-engineer (create-operator.py) ↔ security-engineer (argon2id hashing) — D-052 +- The **security-engineer and devops-engineer are NOT in config.json `personas`** — emergent personas defined in PERSONAS.md (same pattern as v0.2/v0.3). Territory enforcement (warn mode) picks up globs from PERSONAS.md. +- R-AUTH-01 (Secure cookie + no-TLS) is a security-engineer + lead-developer collaboration point for GRILL-v0.4 (config-driven flag resolution must be grill-approved). +- R-VC-MIG-01 (VC key migration) is a security-engineer + data-engineer collaboration point (archive v0.3 public key before activating new key). \ No newline at end of file diff --git a/.ciagent/PLAN-v0.4-operator-tier.md b/.ciagent/PLAN-v0.4-operator-tier.md new file mode 100644 index 0000000..7ced8ae --- /dev/null +++ b/.ciagent/PLAN-v0.4-operator-tier.md @@ -0,0 +1,772 @@ +# Praxis — v0.4 Execution Plan (Operator Tier — Cohort Dashboard + Auth + Postgres) + +> **Milestone:** v0.4 (Operator tier — cohort dashboard, auth, Postgres) +> **Phases:** 2 execution phases (P1: operator foundation — Postgres + auth; P2: cohort dashboard + aggregation) + final phase (P3: review + ship) +> **Ship:** v0.1.6 (Phase 0, already staged) → v0.1.7 (P1) → v0.1.8 (P2) → v0.1.9 (P3 = v0.4 milestone release) +> **Status:** plan +> **Autonomy:** full +> **Parallelization:** enabled, max 5 concurrent agents +> **Personas active (6):** lead-developer, backend-engineer, frontend-engineer (REACTIVATED), data-engineer (EXPANDED), security-engineer (RETAINED), devops-engineer (REACTIVATED) +> **Date:** 2026-08-04 + +--- + +## Phase Split Rationale + +v0.4 is split into 2 execution phases + final review, following the ROADMAP: + +- **P1 (Operator Foundation — Postgres + Auth):** docker-compose Postgres 16 service, asyncpg pool, Postgres operator-tier schema (5 tables), operator auth (argon2id + signed stateless cookies + slowapi rate limit), VC issuer key migration SQLite→Postgres (archive v0.3 public key as `superseded`, fresh v0.4 keypair), operator bootstrap CLI. No UI. Shippable as `v0.1.7`. Covers: REQ-MT-01, REQ-AUTH-01, REQ-NFR-AUTH-01, REQ-NFR-MT-01 + REQ-MT-02 (schema foundation). +- **P2 (Cohort Dashboard + Aggregation):** cohort aggregation pipeline (on-session-end async hook + nightly reconciliation at 03:00 CT, k-anonymity ≥ 10 write-time suppression), React cohort dashboard (3 views: practice/mastery/failure-patterns), `/api/operator/*` cohort endpoints (auth-gated), React Router + SPA fallback. Shippable as `v0.1.8`. Covers: REQ-DASH-01, REQ-NFR-DASH-01, REQ-NFR-DASH-02 + REQ-MT-02 (pipeline completion). +- **P3 (Final — Review + Ship):** multi-persona review, audit, merge to main, milestone release `v0.1.9` = v0.4. + +The split keeps P1 a clean infra/auth milestone (no UI, verifiable by tests + CLI), and P2 a clean feature milestone (dashboard + pipeline, verifiable by UI + API tests). + +--- + +## Key Decisions Honored (D-050..D-057 + research) + +| Decision | Honored in | How | +|----------|-----------|-----| +| D-050 (asyncpg pool min 1/max 10 on app.state.pg_pool via lifespan) | SLICE-01 | lifespan creates pool on startup, closes on shutdown | +| D-051 (VC key migration — fresh keypair in Postgres, v0.3 public key archived as superseded) | SLICE-04, SLICE-06 | migration script archives v0.3 pubkey + generates v0.4 key; e2e test verifies old VC | +| D-052 (scripts/create-operator.py CLI) | SLICE-05 | idempotent insert, argon2id hash, env-provided credentials | +| D-053 (3 dashboard views) | SLICE-08, SLICE-09 | practice/mastery/failure-patterns endpoints + React components | +| D-054 (async fire-and-forget hook + nightly 03:00 CT) | SLICE-07 | asyncio.Task on session end + in-process scheduler loop | +| D-055 (nightly pg_dump to volume, 7-day retention) | SLICE-02 | host-side cron script, %u rolling 7-file | +| D-056 (signed stateless cookies, Starlette SessionMiddleware) | SLICE-03 | itsdangerous HMAC-SHA256, no sessions table | +| D-057 (server-side auth on every /api/operator/* + React guard) | SLICE-03, SLICE-09 | router-level dependencies + GET /api/operator/me on mount | +| R-AUTH-01 (config-driven PRAXIS_COOKIE_SECURE) | SLICE-03 | env var default true; false for HTTP pilot with logged WARNING | +| SPA fallback for React Router /operator/* | SLICE-10 | catch-all route before StaticFiles mount | +| Inline SVG sparklines (zero-dep) | SLICE-09 | ~50 LOC component, no chart library | +| cohort_aggregates plain table (not partitioned) | SLICE-01 | schema ships with (path, window_start) index, no partitioning | + +--- + +# Phase 1 — Operator Foundation (Postgres + Auth) + +**Branch:** `phase/01-operator-foundation` → merged to `milestone/v0.4-operator-tier` +**Ship:** `v0.1.7` (patch release, feature milestone type) +**REQ-IDs covered:** REQ-MT-01, REQ-AUTH-01, REQ-NFR-AUTH-01, REQ-NFR-MT-01, REQ-MT-02 (schema foundation) +**Slices:** 6 vertical slices in 3 waves +**Total tasks:** 29 + +| Wave | Slices | Parallel slots | Description | +|------|--------|----------------|-------------| +| 1 | SLICE-01, SLICE-02 | 2 | Postgres DB foundation (compose + pool + schema + PgStore) + devops config (.env.example + CT bump + backup script) — disjoint file territories | +| 2 | SLICE-03, SLICE-04, SLICE-05 | 3 | Operator auth module + VC issuer key migration + bootstrap CLI — all depend on SLICE-01 schema/pool; disjoint module territories | +| 3 | SLICE-06 | 1 | P1 integration — __main__.py wiring (lifespan+pool, SessionMiddleware, auth routes, verification store swap) + integration tests + VC migration e2e | + +### Wave dependency graph (P1) + +``` +Wave 1 ────────────────────────────────────────────────────── + SLICE-01 (Postgres DB foundation: compose + pool + schema + PgStore) + SLICE-02 (devops config: .env.example + CT bump + backup cron) + │ + ▼ +Wave 2 ────────────────────────────────────────────────────── + SLICE-03 (operator auth: argon2id + cookies + rate limit + deps) ← depends on SLICE-01 (operators table + PgStore) + SLICE-04 (VC key migration: IssuerKeyStore + archive v0.3 key) ← depends on SLICE-01 (issuer_keys table + PgStore) + SLICE-05 (operator bootstrap CLI: create-operator.py) ← depends on SLICE-01 (PgStore + operators table) + │ + ▼ +Wave 3 ────────────────────────────────────────────────────── + SLICE-06 (P1 integration: __main__.py wiring + e2e tests) ← depends on SLICE-03, SLICE-04, SLICE-05 +``` + +### Persona load distribution (P1) + +| Persona | Tasks | Primary territory | +|---------|-------|-------------------| +| lead-developer | 5 | docker-compose.yml, pyproject.toml, integration orchestration | +| data-engineer | 8 | db/pg_schema.sql, db/pg_migrations/, db/pg_migrate.py, db/pg_store.py | +| backend-engineer | 5 | server/__main__.py (lifespan + wiring), integration tests | +| security-engineer | 8 | server/auth/ (argon2 + cookies + rate limit + deps), server/vc/ (IssuerKeyStore + migration) | +| devops-engineer | 5 | .env.example, scripts/proxmox/lxc-clone.sh, scripts/backup-pg.sh, scripts/create-operator.py | +| frontend-engineer | 0 | not active in P1 (no UI) | + +--- + +## SLICE-01: Postgres DB Foundation (W1) + +- **Goal:** Stand up Postgres 16 as a second Docker service with asyncpg pool, migration runner, and the full operator-tier schema (5 tables). The critical-path foundation for all P1/P2 work. +- **REQ-IDs covered:** REQ-MT-01 (Postgres store), REQ-NFR-MT-01 (Postgres-in-LXC without destabilizing learner service), REQ-MT-02 (schema foundation — cohort_aggregates table) +- **Wave:** 1 +- **Dependencies:** none +- **Primary persona:** lead-developer +- **Supporting personas:** data-engineer (schema + migrations + pg_store + pg_migrate), backend-engineer (pool lifespan), devops-engineer (compose volumes/network consultation) + +### Tasks + +#### TASK-01-01 — docker-compose Postgres service + praxis-net + volumes +- **Persona:** lead-developer +- **File:** `docker-compose.yml` (extend) +- **Content:** Add `postgres` service (postgres:16-slim, restart: unless-stopped, env: POSTGRES_USER/PASSWORD/DB/PGDATA, env_file server.env, pgdata+pgbackups volumes, pg_isready healthcheck 10s/5ret/5s timeout, praxis-net network, no published ports). Add `praxis` service `depends_on: { postgres: { condition: service_healthy } }` + `networks: [praxis-net]`. Add `pgdata`, `pgbackups` named volumes + `praxis-net` bridge network. Keep existing `praxis-data` volume + all v0.2 env vars. +- **Acceptance criteria:** `docker compose config` validates; `docker compose up -d postgres` → healthcheck passes within 30s; praxis service starts after postgres healthy; no published port on postgres (verified `docker port` shows nothing). + +#### TASK-01-02 — pyproject.toml new deps +- **Persona:** lead-developer +- **File:** `pyproject.toml` (extend) +- **Content:** Add `asyncpg>=0.29`, `argon2-cffi>=23.1`, `slowapi>=0.1` to dependencies. These are the 3 new v0.4 pip deps (RESEARCH-v0.4 §new-deps). +- **Acceptance criteria:** `pip install -e .` succeeds; `import asyncpg`, `import argon2`, `import slowapi` all work. + +#### TASK-01-03 — asyncpg pool lifespan in server/__main__.py +- **Persona:** backend-engineer +- **File:** `server/__main__.py` (extend — add lifespan) +- **Content:** Add `@asynccontextmanager async def lifespan(app)` that creates `asyncpg.create_pool(dsn=os.environ["PRAXIS_PG_DSN"], min_size=1, max_size=10, command_timeout=10)` on `app.state.pg_pool`, runs `pg_migrate.apply_pg_migrations(pool)` on startup, closes pool on shutdown. Pass `lifespan=lifespan` to `FastAPI(...)`. If `PRAXIS_PG_DSN` is unset, log WARNING and skip pool (graceful — dev mode without Postgres). The existing `_store` (PraxisStore/SQLite) remains for learner state. +- **Acceptance criteria:** With Postgres running, `app.state.pg_pool` is an asyncpg.Pool instance on startup; migrations applied (tables exist); pool closed cleanly on shutdown. Without Postgres (no DSN), server starts with WARNING, learner voice loop still works (SQLite unaffected). + +#### TASK-01-04 — db/pg_migrate.py — asyncpg migration runner +- **Persona:** data-engineer +- **File:** `db/pg_migrate.py` (new) +- **Content:** Mirror `db/migrate.py` pattern. `async def apply_pg_migrations(pool: asyncpg.Pool) -> list[str]` — creates `_pg_migrations` tracking table, reads `db/pg_migrations/*.sql` in sorted order, applies pending migrations within a transaction, records in `_pg_migrations`. Idempotent — no-op if all applied. Retries on connection failure (3 attempts, 2s backoff — R-MT-02 mitigation). +- **Acceptance criteria:** Re-running `apply_pg_migrations(pool)` is a no-op (returns empty list). Migration files apply in order. Connection failure retries 3x then raises. + +#### TASK-01-05 — db/pg_schema.sql + db/pg_migrations/0001_operator_tier.sql +- **Persona:** data-engineer +- **Files:** `db/pg_schema.sql` (new — reference), `db/pg_migrations/0001_operator_tier.sql` (new — applied by pg_migrate) +- **Content:** 5 tables per ARCHITECTURE.md §Postgres Schema: + - `operators` (id UUID DEFAULT gen_random_uuid() PK, username TEXT UNIQUE NOT NULL, password_hash TEXT NOT NULL, display_name TEXT, role TEXT DEFAULT 'operator', is_active BOOLEAN DEFAULT TRUE, created_at TIMESTAMPTZ DEFAULT now(), last_login_at TIMESTAMPTZ) + - `issued_credentials` (id UUID PK, operator_id UUID REFERENCES operators, learner_ref TEXT NOT NULL, vc_type TEXT, payload_jsonb JSONB NOT NULL, signature_b64 TEXT NOT NULL, status TEXT DEFAULT 'active', issued_at TIMESTAMPTZ DEFAULT now(), revoked_at TIMESTAMPTZ) + - `mastery_gate_events` (id UUID DEFAULT gen_random_uuid() PK, learner_ref TEXT NOT NULL, scenario_id TEXT, path_id TEXT NOT NULL, gate_outcome TEXT, rubric_scores_jsonb JSONB, recorded_at TIMESTAMPTZ DEFAULT now(), source TEXT DEFAULT 'sync') + - `cohort_aggregates` (path TEXT NOT NULL, metric TEXT NOT NULL, window_start DATE NOT NULL, window_end DATE NOT NULL, value NUMERIC, cell_count INTEGER NOT NULL DEFAULT 0, cell_suppressed BOOLEAN NOT NULL DEFAULT FALSE, updated_at TIMESTAMPTZ DEFAULT now(), PRIMARY KEY (path, metric, window_start)) — **plain table, NOT partitioned** (D-050..D-053; RESEARCH-v0.4 §1.7). Index on `(path, window_start)`. + - `issuer_keys` (id TEXT PK, public_key TEXT NOT NULL, private_key_enc BYTEA, status TEXT NOT NULL DEFAULT 'active', created_at TIMESTAMPTZ DEFAULT now()) + - All use `gen_random_uuid()` (PG16 core, no extension — R-MT-05 verified). +- **Acceptance criteria:** `apply_pg_migrations(pool)` creates all 5 tables + `_pg_migrations` tracking table. `\d operators` in psql shows expected columns. `gen_random_uuid()` works without extension. `cohort_aggregates` has no partitioning (confirmed via `\d+`). + +#### TASK-01-06 — db/pg_store.py — PgStore class +- **Persona:** data-engineer +- **File:** `db/pg_store.py` (new) +- **Content:** `class PgStore` — accepts an `asyncpg.Pool` in constructor. Methods: + - Operator CRUD: `get_operator_by_username(username) -> dict | None`, `get_operator_by_id(id) -> dict | None`, `update_last_login(id)`, `insert_operator(username, password_hash, display_name) -> str` (ON CONFLICT DO NOTHING, returns id). + - Cohort aggregate read: `get_cohort_aggregates(path, metric, since_date) -> list[dict]` (returns rows with value, cell_count, cell_suppressed, updated_at). + - Cohort aggregate write: `upsert_cohort_aggregate(path, metric, window_start, window_end, value, cell_count, cell_suppressed)` (ON CONFLICT (path, metric, window_start) DO UPDATE). + - Issuer key methods (implements IssuerKeyStore protocol — SLICE-04): `init_issuer_key(key_id, public_key, private_key_enc)`, `get_active_signing_key_row() -> dict | None`, `get_public_key_row(key_id) -> dict | None`, `set_issuer_key_superseded(key_id)`. + - Credential methods: `insert_credential(...)`, `get_credential(id) -> dict | None`, `set_credential_status(id, status)`. + - Mastery gate event: `record_gate_event(learner_ref, path_id, scenario_id, gate_outcome, rubric_scores_jsonb)`. + - All async, use `pool.acquire()` context manager. +- **Acceptance criteria:** Each method has a unit test with a real Postgres pool (testcontainers or local PG). Round-trip insert+query works. ON CONFLICT upsert is idempotent. No cross-DB joins (D-031). `learner_ref` is opaque string (not FK). + +#### TASK-01-07 — PgStore + pool integration test +- **Persona:** data-engineer +- **File:** `tests/test_pg_store.py` (new) +- **Content:** Integration test requiring a Postgres instance (skip if `PRAXIS_PG_DSN` not set). Tests: pool creation, migration application, operator insert+query, cohort_aggregate upsert idempotency, issuer_key insert+query, credential insert+query. Verifies the full DB stack works end-to-end. +- **Acceptance criteria:** All tests pass when Postgres is available; tests skip gracefully when `PRAXIS_PG_DSN` is unset (no hard CI dependency on Postgres). + +--- + +## SLICE-02: DevOps Config — .env.example + CT Bump + Backup (W1) + +- **Goal:** Update deployment config for Postgres-in-LXC: operator env vars, CT memory bump (4→6GB), nightly backup cron script. +- **REQ-IDs covered:** REQ-NFR-MT-01 (Postgres-in-LXC without destabilizing — CT sizing + backup) +- **Wave:** 1 +- **Dependencies:** none (parallel with SLICE-01 — disjoint files: .env.example, scripts/proxmox/ vs docker-compose.yml, db/, server/) +- **Primary persona:** devops-engineer +- **Supporting personas:** lead-developer (compose env consultation) + +### Tasks + +#### TASK-02-01 — .env.example operator vars +- **Persona:** devops-engineer +- **File:** `.env.example` (extend) +- **Content:** Add v0.4 operator vars with documentation comments: + - `PRAXIS_PG_PASSWORD` (Postgres password — secret) + - `PRAXIS_PG_DSN` (full DSN: `postgresql://praxis:${PRAXIS_PG_PASSWORD}@postgres:5432/praxis`) + - `PRAXIS_COOKIE_SECRET` (≥32 bytes random — secret) + - `PRAXIS_COOKIE_SECURE` (default `true`; set `false` for HTTP pilot — R-AUTH-01) + - `PRAXIS_BOOTSTRAP_OPERATOR_USER` (initial operator username — secret) + - `PRAXIS_BOOTSTRAP_OPERATOR_PASS` (initial operator password — secret) + - `PRAXIS_VC_ISSUER_KEY` (VC issuer root key — already in v0.3, document for v0.4 migration) +- **Acceptance criteria:** `.env.example` is documentation-only (no real secrets). All vars have comments explaining purpose + when to set. File is gitignored-safe (`.env.example` is committed, `.env.secrets` is not — verified in `.gitignore`). + +#### TASK-02-02 — CT memory bump in lxc-clone.sh +- **Persona:** devops-engineer +- **File:** `scripts/proxmox/lxc-clone.sh` (extend) +- **Content:** Change `memory=${PROXMOX_MEMORY_MB:-4096}` → `memory=${PROXMOX_MEMORY_MB:-6144}` (4GB→6GB per REQ-NFR-MT-01, RESEARCH-v0.4 §1.1). Add comment explaining Postgres ~400MB + praxis ~500MB + Docker ~200MB + build headroom ~1GB + margin. +- **Acceptance criteria:** `lxc-clone.sh` defaults to 6144MB. Existing override via `PROXMOX_MEMORY_MB` env still works. Bats tests (if any check memory) updated. + +#### TASK-02-03 — Backup cron script +- **Persona:** devops-engineer +- **File:** `scripts/backup-pg.sh` (new) +- **Content:** Host-side cron script (decoupled from praxis service uptime — RESEARCH-v0.4 §1.5). Runs `docker compose exec -T postgres pg_dump -U praxis -Fc praxis -f /backups/praxis-$(date +%u).dump`. The `%u` = day-of-week 1-7 → rolling 7-file retention with zero cleanup logic (D-055). Includes a restore drill comment block: `pg_restore --clean --if-exists /backups/praxis_3.dump` (never restore into live DB without stopping praxis first). Script is idempotent — overwrites the day-of-week file. +- **Acceptance criteria:** Script executes without error when postgres is running. Produces a compressed dump file at `/backups/praxis-.dump`. Re-running overwrites the same file. Restore drill documented in comments. Script is POSIX-sh compatible (no bashisms). + +--- + +## SLICE-03: Operator Auth Module (W2) + +- **Goal:** Implement the operator auth stack: argon2id password hashing, signed stateless cookies (Starlette SessionMiddleware), slowapi rate limiting, and the `current_operator` dependency. The auth route handlers (login/logout/me) are in this slice; __main__.py mounting is in SLICE-06. +- **REQ-IDs covered:** REQ-AUTH-01, REQ-NFR-AUTH-01 +- **Wave:** 2 +- **Dependencies:** SLICE-01 (operators table + PgStore for operator lookup) +- **Primary persona:** security-engineer +- **Supporting personas:** backend-engineer (FastAPI route patterns) + +### Tasks + +#### TASK-03-01 — argon2id password hashing +- **Persona:** security-engineer +- **File:** `server/auth/passwords.py` (new) +- **Content:** `from argon2 import PasswordHasher`. `_ph = PasswordHasher()` (defaults: time_cost=3, memory_cost=64MiB, parallelism=4 — exceeds OWASP minimums per RESEARCH-v0.4 §2.1). `hash_password(plain: str) -> str`, `verify_password(stored_hash: str, plain: str) -> bool` (catches VerifyMismatchError → False), `needs_rehash(stored_hash: str) -> bool` (delegates to `_ph.check_needs_rehash`). Login flow calls `needs_rehash` after successful verify → rehash if params bumped. +- **Acceptance criteria:** hash→verify round-trip works. Wrong password returns False (no exception). `needs_rehash` returns False for current defaults, True if params are bumped. Hashing latency < 1s (R-AUTH-02 — single operator, low frequency). + +#### TASK-03-02 — Signed cookie configuration (SessionMiddleware) +- **Persona:** security-engineer +- **File:** `server/auth/cookies.py` (new) +- **Content:** `def get_session_middleware_kwargs() -> dict` — returns kwargs for `SessionMiddleware`: `secret_key=os.environ["PRAXIS_COOKIE_SECRET"]`, `session_cookie="praxis_op"`, `max_age=28800` (8h — D-041), `httponly=True`, `samesite="strict"`, `secure=_env_bool("PRAXIS_COOKIE_SECURE", True)`, `path="/"`. If `PRAXIS_COOKIE_SECURE=false`, log WARNING: "Cookie Secure flag disabled — HTTP pilot mode (R-AUTH-01). Do not use in production." `_env_bool` parses "true"/"false"/"1"/"0". If `PRAXIS_COOKIE_SECRET` is unset, generate a random one + log WARNING (dev only — not for pilot). +- **Acceptance criteria:** Cookie kwargs match D-041/D-056 spec. `secure=False` logs WARNING. Missing secret generates random + WARNING. Cookie name is `praxis_op` (distinct from any future learner cookie). + +#### TASK-03-03 — Login rate limiter (slowapi) +- **Persona:** security-engineer +- **File:** `server/auth/rate_limit.py` (new) +- **Content:** `from slowapi import Limiter`. `limiter = Limiter(key_func=get_remote_address)` (in-memory backend, single-instance — D-041). `def rate_limit_login() -> callable` — returns a decorator `@limiter.limit("5/minute")` for the login route. 429 + `Retry-After` header on exceed. Document the hand-rolled counter fallback in comments (RESEARCH-v0.4 §2.5). +- **Acceptance criteria:** 6th login attempt within 1 minute returns 429 with Retry-After. Rate limit is per-IP. Counter resets after 1 minute. R-AUTH-03 (in-memory lost on restart) documented as accepted pilot risk. + +#### TASK-03-04 — current_operator dependency +- **Persona:** security-engineer +- **File:** `server/auth/dependencies.py` (new) +- **Content:** `async def current_operator(request: Request) -> Operator` — reads `request.session.get("operator_id")`; if missing → raise `HTTPException(401, "not authenticated")`; fetches operator from PgStore by id; if not found or `is_active=False` → 401 + clear session; returns `Operator` dataclass (id, username, display_name, role). This is the server-side auth enforcement (D-057) — every `/api/operator/*` protected route uses `Depends(current_operator)`. +- **Acceptance criteria:** No cookie → 401. Invalid/expired cookie → 401. Valid cookie + active operator → returns Operator. Valid cookie + inactive operator → 401 + session cleared. The dependency never trusts the client (D-057). + +#### TASK-03-05 — Auth route handlers (login, logout, me) +- **Persona:** security-engineer +- **File:** `server/auth/routes.py` (new) +- **Content:** `APIRouter(prefix="/api/operator")` with: + - `POST /login` — rate-limited (TASK-03-03). Body: `{username, password}`. Fetches operator from PgStore, `verify_password`, on success sets `request.session["operator_id"] = op.id`, updates `last_login_at`, returns `{operator: {id, username, display_name}}`. On failure → 401. If `needs_rehash` → rehash + update store. + - `POST /logout` — `Depends(current_operator)` — clears `request.session`, returns `{ok: true}`. (Stateless — client also clears cookie; D-056.) + - `GET /me` — `Depends(current_operator)` — returns `{operator: {id, username, display_name, role}}`. This is the React route guard endpoint (D-057). + - Login + logout are outside the protected router (login is rate-limited, not auth-gated; logout is auth-gated but on the same router). +- **Acceptance criteria:** Login with correct creds → 200 + cookie set. Login with wrong creds → 401 + no cookie. 6th attempt → 429. `/me` with valid cookie → 200. `/me` without cookie → 401. `/logout` clears session. + +#### TASK-03-06 — Auth unit tests +- **Persona:** security-engineer +- **File:** `tests/test_auth.py` (new) +- **Content:** Unit tests for passwords (hash/verify/rehash), cookie config (secure flag logic, warning on false), rate limiter (5/min threshold), current_operator dependency (401 cases, active/inactive), login/logout/me route handlers (with mocked PgStore). Tests do not require a real Postgres (mock PgStore). +- **Acceptance criteria:** All tests pass with mocked PgStore. Coverage: password verify fail, rate limit, 401 on missing/invalid/expired cookie, 401 on inactive operator, rehash on login. + +--- + +## SLICE-04: VC Issuer Key Migration (W2) + +- **Goal:** Migrate the VC issuer key store from SQLite to Postgres. Refactor `issuer_keys.py` to an `IssuerKeyStore` protocol (both PraxisStore and PgStore implement it). Archive the v0.3 public key as `superseded` in Postgres. Generate a fresh v0.4 keypair. Update verification to use PgStore. +- **REQ-IDs covered:** REQ-MT-01 (issuer_keys in Postgres — partial) +- **Wave:** 2 +- **Dependencies:** SLICE-01 (issuer_keys table + PgStore issuer key methods) +- **Primary persona:** security-engineer +- **Supporting personas:** data-engineer (PgStore issuer key implementation) + +### Tasks + +#### TASK-04-01 — IssuerKeyStore protocol/ABC +- **Persona:** security-engineer +- **File:** `server/vc/issuer_keys.py` (refactor) +- **Content:** Define `class IssuerKeyStore(Protocol)` with methods: `init_issuer_key(key_id, public_key, private_key_enc)`, `get_active_signing_key_row() -> dict | None`, `get_public_key_row(key_id) -> dict | None`, `set_issuer_key_superseded(key_id)`. Refactor existing functions (`init_issuer_key`, `get_active_signing_key`, `get_public_key_for_verification`, `rotate_key`) to accept `IssuerKeyStore` instead of `PraxisStore`. The existing `PraxisStore` already implements these methods (duck-typing) — the protocol formalizes the interface. Keep `_encrypt_private_key`, `_decrypt_private_key`, `_verification_method`, `KeyPair` unchanged. R-VC-MIG-03 mitigation: both stores implement the same protocol. +- **Acceptance criteria:** `PraxisStore` passes `isinstance(store, IssuerKeyStore)` (or structural check). `PgStore` passes the same. Existing v0.3 tests still pass (PraxisStore path unchanged). No breaking change to function signatures beyond the type annotation. + +#### TASK-04-02 — PgStore issuer key methods +- **Persona:** data-engineer +- **File:** `db/pg_store.py` (extend — SLICE-01 stubs, now full implementation) +- **Content:** Full implementation of the 4 IssuerKeyStore methods using asyncpg. `init_issuer_key` → INSERT with `gen_random_uuid()` or provided key_id. `get_active_signing_key_row` → SELECT WHERE status='active' ORDER BY created_at DESC LIMIT 1. `get_public_key_row` → SELECT WHERE id=$1 (queries by id, not status — **this is the superseded key fallback** per D-051). `set_issuer_key_superseded` → UPDATE status='superseded' WHERE id=$1. `private_key_enc` is BYTEA in Postgres (vs BLOB in SQLite). +- **Acceptance criteria:** All 4 methods work with real Postgres. `get_public_key_row` finds both active AND superseded keys by id (R-VC-MIG-01 mitigation — verification fallback). Round-trip: init → get_active → set_superseded → get_public_key(superseded id) still returns the row. + +#### TASK-04-03 — VC key migration script +- **Persona:** security-engineer +- **File:** `server/vc/migrate_keys.py` (new) +- **Content:** `async def migrate_issuer_keys(sqlite_store: PraxisStore, pg_store: PgStore, root_key: bytes) -> dict` — the one-time migration procedure (D-051): + 1. Read v0.3 active public key from SQLite `issuer_keys` (status='active'). + 2. Insert that public key into Postgres `issuer_keys` with status='superseded' (private key NOT migrated — only public key archived for verification). + 3. Generate a fresh Ed25519 keypair in Postgres `issuer_keys` with status='active' (encrypted at rest with root key — same nacl.SecretBox pattern). + 4. Return `{archived_key_id, new_key_id}`. + Idempotent: if Postgres already has an active key, skip steps 2-3 (no-op). If Postgres has a superseded key matching the v0.3 key_id, skip step 2. + **R-VC-MIG-01 mitigation: archive the v0.3 public key BEFORE activating the new key.** The script does step 2 before step 3. +- **Acceptance criteria:** Running the migration on a fresh Postgres: v0.3 public key appears as superseded, fresh key appears as active. Re-running is a no-op. v0.3 VCs still verify against the archived (superseded) public key. + +#### TASK-04-04 — Verification endpoint store swap +- **Persona:** security-engineer +- **File:** `server/vc/verification.py` (extend) +- **Content:** `verify_credential` currently takes `PraxisStore`. Refactor to accept either `PraxisStore` (v0.3 SQLite) or `PgStore` (v0.4 Postgres) via the IssuerKeyStore protocol for key lookup. For credential lookup: try Postgres `issued_credentials` first; if not found, fall back to SQLite `issued_credentials` (v0.3 credentials remain in SQLite — no data migration per D-051 "no re-issuance"). The key lookup always uses the passed store. Add a `store` parameter that implements both credential + key lookup. **The __main__.py wiring (passing PgStore) is in SLICE-06.** +- **Acceptance criteria:** `verify_credential` works with PraxisStore (v0.3 path — existing tests pass). `verify_credential` works with PgStore (v0.4 path — new test). v0.3 credential in SQLite + v0.3 key archived as superseded in Postgres → verifies ✓. + +#### TASK-04-05 — VC migration unit tests +- **Persona:** security-engineer +- **File:** `tests/test_vc_migration.py` (new) +- **Content:** Tests with mocked stores: + - Migration script: v0.3 key archived as superseded, fresh key active. Idempotent re-run. + - Verification with PgStore: v0.4 VC (active key) verifies ✓. v0.3 VC (superseded key) verifies ✓ (R-VC-MIG-01 — the critical test). + - Verification fallback: `get_public_key_row` finds superseded key by id. + - Root key handling: v0.4 active key encrypted with v0.4 root key (R-VC-MIG-02 — v0.3 root key kept for v0.3 SQLite path). +- **Acceptance criteria:** All tests pass. R-VC-MIG-01 explicitly tested: a v0.3 VC verifies against a Postgres store with the v0.3 public key archived as superseded. + +--- + +## SLICE-05: Operator Bootstrap CLI (W2) + +- **Goal:** Implement `scripts/create-operator.py` — the first-run CLI that creates the initial operator from env-provided credentials (D-052). +- **REQ-IDs covered:** REQ-AUTH-01 (operator account provisioning — partial) +- **Wave:** 2 +- **Dependencies:** SLICE-01 (PgStore + operators table), SLICE-03 (argon2id hashing — TASK-03-01) +- **Primary persona:** devops-engineer +- **Supporting personas:** security-engineer (argon2id hashing pattern) + +### Tasks + +#### TASK-05-01 — scripts/create-operator.py +- **Persona:** devops-engineer +- **File:** `scripts/create-operator.py` (new) +- **Content:** CLI script that: + 1. Reads `PRAXIS_BOOTSTRAP_OPERATOR_USER` + `PRAXIS_BOOTSTRAP_OPERATOR_PASS` from env. If either missing → print error + exit 1 (R-BOOT-02). + 2. Reads `PRAXIS_PG_DSN` from env. If missing → print error + exit 1. + 3. Creates asyncpg pool, applies migrations (ensure schema exists). + 4. Hashes password with `argon2.PasswordHasher().hash(password)` (same defaults as TASK-03-01). + 5. `INSERT INTO operators (username, password_hash, display_name) VALUES ($1, $2, $3) ON CONFLICT (username) DO NOTHING` (idempotent — D-052). + 6. Prints `created` or `already exists` + exits 0. + 7. `--update` flag: `ON CONFLICT (username) DO UPDATE SET password_hash = excluded.password_hash` (force rehash — RESEARCH-v0.4 §open-questions #4). + 8. Retries on connection failure (3 attempts, 5s backoff — R-BOOT-01). +- **Acceptance criteria:** Running with valid env vars creates the operator. Re-running prints "already exists" (no password update). `--update` flag rehashes + updates. Missing env var → clear error + exit 1. Connection failure → retries 3x then clear error. + +#### TASK-05-02 — config.json secrets scope + .env.secrets template +- **Persona:** devops-engineer +- **File:** `.ciagent/config.json` (extend secrets.scopes), `.ciagent/.env.secrets.example` (new — template, not the real secrets) +- **Content:** Add `operator` scope to `config.json` secrets.scopes: `{"name": "operator", "env_vars": ["PRAXIS_PG_PASSWORD", "PRAXIS_COOKIE_SECRET", "PRAXIS_BOOTSTRAP_OPERATOR_USER", "PRAXIS_BOOTSTRAP_OPERATOR_PASS", "PRAXIS_VC_ISSUER_KEY"]}`. Create `.env.secrets.example` documenting all operator secret vars (committed; the real `.env.secrets` is gitignored). +- **Acceptance criteria:** `config.json` validates. New scope appears in secrets.scopes. `.env.secrets.example` is committed (no real secrets). `.env.secrets` is gitignored (verified). + +#### TASK-05-03 — Bootstrap CLI test +- **Persona:** devops-engineer +- **File:** `tests/test_create_operator.py` (new) +- **Content:** Test with mocked PgStore: create operator → verify exists in store. Re-run → "already exists" (no password update). `--update` → password updated. Missing env → exit 1. Verify password is argon2id hashed (not plaintext). +- **Acceptance criteria:** All tests pass with mocked PgStore. Password hash starts with `$argon2id$` (not plaintext). Idempotent on re-run. + +--- + +## SLICE-06: P1 Integration (W3) + +- **Goal:** Wire all P1 modules into `server/__main__.py`: lifespan pool, SessionMiddleware, auth routes, verification store swap. Run end-to-end P1 integration tests including the critical VC migration e2e test (R-VC-MIG-01). +- **REQ-IDs covered:** REQ-MT-01 (full integration), REQ-AUTH-01 (auth wired), REQ-NFR-AUTH-01 (auth NFRs verified end-to-end), REQ-NFR-MT-01 (Postgres + learner service coexist) +- **Wave:** 3 +- **Dependencies:** SLICE-03 (auth module), SLICE-04 (VC migration), SLICE-05 (bootstrap CLI) +- **Primary persona:** backend-engineer +- **Supporting personas:** lead-developer (integration orchestration), security-engineer (VC migration e2e) + +### Tasks + +#### TASK-06-01 — __main__.py — mount SessionMiddleware + lifespan pool +- **Persona:** backend-engineer +- **File:** `server/__main__.py` (extend) +- **Content:** Add `SessionMiddleware` with kwargs from `server.auth.cookies.get_session_middleware_kwargs()`. Add the lifespan context manager (from TASK-01-03) to the FastAPI app. The lifespan creates the asyncpg pool + runs pg_migrate. Create a `PgStore(pool)` instance on `app.state.pg_store` when pool is available. Keep the existing `_store` (PraxisStore/SQLite) for learner state. `SessionMiddleware` is added BEFORE CORS middleware (middleware order: outermost first — SessionMiddleware should be outermost to sign cookies before CORS headers). +- **Acceptance criteria:** With Postgres: `app.state.pg_pool` + `app.state.pg_store` populated on startup. Without Postgres: server starts with WARNING, voice loop works, auth routes return 503 (service unavailable — no operator store). Cookie `praxis_op` is signed (itsdangerous). + +#### TASK-06-02 — __main__.py — mount auth routes +- **Persona:** backend-engineer +- **File:** `server/__main__.py` (extend) +- **Content:** `from server.auth.routes import router as auth_router`. `app.include_router(auth_router)` — mounts `/api/operator/login`, `/api/operator/logout`, `/api/operator/me`. The auth routes use `app.state.pg_store` for operator lookup. If `pg_store` is None (no Postgres), auth routes return 503. Register auth routes BEFORE the StaticFiles mount (routes-before-static-mount constraint — carry-forward from v0.2). +- **Acceptance criteria:** `POST /api/operator/login` with valid creds → 200 + cookie. `GET /api/operator/me` with cookie → 200. Without cookie → 401. Routes are matched before StaticFiles (verified: `/api/operator/login` returns JSON, not index.html). + +#### TASK-06-03 — __main__.py — swap verification endpoint to PgStore +- **Persona:** backend-engineer +- **File:** `server/__main__.py` (extend) +- **Content:** Update the existing `/vc/verify/{credential_id}` route: if `app.state.pg_store` is available, use it for issuer key lookup (PgStore) + credential lookup (try Postgres first, fall back to SQLite for v0.3 credentials per TASK-04-04). If `pg_store` is None (no Postgres), fall back to the existing PraxisStore path (v0.3 compat). Run the VC key migration on first boot: if PgStore has no active issuer key, call `migrate_issuer_keys(_store, pg_store, root_key)` (from TASK-04-03). +- **Acceptance criteria:** With Postgres: `/vc/verify/` → verifies against archived superseded key in Postgres ✓. `/vc/verify/` → verifies against active key in Postgres ✓. Without Postgres: `/vc/verify` falls back to SQLite (v0.3 compat). VC key migration runs once on first boot (idempotent). + +#### TASK-06-04 — P1 integration test (auth end-to-end) +- **Persona:** backend-engineer +- **File:** `tests/test_p1_auth_integration.py` (new — requires Postgres, skip if no DSN) +- **Content:** End-to-end auth flow: create operator via bootstrap CLI → POST /login → GET /me → POST /logout → GET /me (401). Test rate limiting (6th attempt → 429). Test cookie attributes (httpOnly, SameSite=Strict, secure per PRAXIS_COOKIE_SECURE). Test 8h expiry (mock time or check max_age). Test that learner voice loop (`/health`, `/pipecat/webrtc`) is unaffected by auth (REQ-NFR-MT-01 — Postgres + learner service coexist). +- **Acceptance criteria:** Full auth flow works. Rate limit enforces 5/min. Cookie attributes match D-041/D-056. Learner voice loop unaffected (health check passes, WebRTC offer accepted — Postgres presence doesn't destabilize). + +#### TASK-06-05 — VC migration e2e test (R-VC-MIG-01 — critical) +- **Persona:** security-engineer +- **File:** `tests/test_p1_vc_migration_e2e.py` (new — requires Postgres, skip if no DSN) +- **Content:** The critical R-VC-MIG-01 test: + 1. Seed SQLite with a v0.3 issuer key + a v0.3-issued credential (or use existing test fixtures). + 2. Start the server with Postgres → migration runs automatically. + 3. Verify Postgres has: 1 superseded key (v0.3 public key) + 1 active key (v0.4 fresh keypair). + 4. `GET /vc/verify/` → `valid: true` (verifies against archived superseded key — **R-VC-MIG-01 PASS**). + 5. Issue a new v0.4 credential (via mastery flow or test helper) → `GET /vc/verify/` → `valid: true`. + 6. Tamper v0.3 credential → verify fails. + 7. Re-run server → migration is no-op (idempotent). +- **Acceptance criteria:** v0.3 VC verifies against Postgres store with archived superseded key (R-VC-MIG-01 explicitly verified). v0.4 VC verifies against active key. Migration is idempotent. Tamper detection works. + +--- + +# Phase 2 — Cohort Dashboard + Aggregation + +**Branch:** `phase/02-cohort-dashboard` → merged to `milestone/v0.4-operator-tier` +**Ship:** `v0.1.8` (patch release, feature milestone type) +**REQ-IDs covered:** REQ-DASH-01, REQ-NFR-DASH-01, REQ-NFR-DASH-02, REQ-MT-02 (pipeline completion) +**Slices:** 4 vertical slices in 2 waves +**Total tasks:** 23 + +| Wave | Slices | Parallel slots | Description | +|------|--------|----------------|-------------| +| 1 | SLICE-07, SLICE-08, SLICE-09 | 3 | Cohort aggregation pipeline + operator API endpoints + React dashboard (parallel — disjoint file territories: server/cohort/ + session_recorder.py, server/operator/, client/) | +| 2 | SLICE-10 | 1 | P2 integration — __main__.py wiring (SPA fallback + operator router mount) + end-to-end aggregation→endpoint→dashboard tests | + +### Wave dependency graph (P2) + +``` +Wave 1 ────────────────────────────────────────────────────── + SLICE-07 (aggregation pipeline: hook + nightly + k-anon) ← depends on P1 SLICE-01 (cohort_aggregates schema + PgStore) + SLICE-08 (operator API endpoints: cohort/mastery/failure) ← depends on P1 SLICE-03 (auth deps) + SLICE-01 (PgStore) + SLICE-09 (React dashboard + Router + sparklines) ← depends on P1 SLICE-03 (auth API contract) + API contract from SLICE-08 + │ + ▼ +Wave 2 ────────────────────────────────────────────────────── + SLICE-10 (P2 integration: SPA fallback + router mount + e2e tests) ← depends on SLICE-07, SLICE-08, SLICE-09 +``` + +### Persona load distribution (P2) + +| Persona | Tasks | Primary territory | +|---------|-------|-------------------| +| backend-engineer | 11 | server/cohort/ (aggregation), server/operator/ (endpoints), server/__main__.py (SPA fallback + router mount), session_recorder.py | +| frontend-engineer | 7 | client/src/operator/, client/src/App.tsx, client/package.json | +| data-engineer | 3 | k-anonymity suppression SQL (supporting), cohort query optimization (supporting) | +| security-engineer | 1 | auth-gated endpoint verification (supporting in integration) | +| lead-developer | 1 | integration orchestration | + +--- + +## SLICE-07: Cohort Aggregation Pipeline (W1) + +- **Goal:** Implement the cohort aggregation pipeline: on-session-end async fire-and-forget hook, nightly reconciliation job at 03:00 CT, k-anonymity ≥ 10 write-time suppression. Chain the hook into `session_recorder.py` after the mastery flow. +- **REQ-IDs covered:** REQ-MT-02 (pipeline completion), REQ-NFR-DASH-02 (freshness ≤ 24h) +- **Wave:** 1 +- **Dependencies:** P1 SLICE-01 (cohort_aggregates table + PgStore upsert method) +- **Primary persona:** backend-engineer +- **Supporting personas:** data-engineer (k-anonymity suppression SQL), security-engineer (learner_ref opaque — no PII) + +### Tasks + +#### TASK-07-01 — Aggregation logic + k-anonymity suppression +- **Persona:** backend-engineer +- **File:** `server/cohort/aggregator.py` (new) +- **Supporting:** data-engineer (suppression SQL) +- **Content:** `async def aggregate_session(pg_store: PgStore, session_outcome: dict) -> None` — computes k-anonymized aggregates for the affected `(path, metric, window_start)` bins and upserts to `cohort_aggregates`. The `session_outcome` dict contains: learner_ref (opaque string — D-031), path, scenario_id, outcome (pass/fail), rubric_scores, failure_mode, branch_path, timestamp. + - Metrics computed: `sessions_count`, `active_learners_count`, `gate_open_rate`, `median_mastery_score`, `failure_mode_frequency`, `rubric_criterion_means`, `week_distribution`. + - **k-anonymity suppression (D-034, REQ-NFR-DASH-01):** `COUNT(DISTINCT learner_ref) >= 10` check per cell. If < 10 → `cell_suppressed=TRUE`, `value=NULL`. Suppression is at write time (auditable — RESEARCH-v0.4 §3.1). + - **Idempotent upsert:** `ON CONFLICT (path, metric, window_start) DO UPDATE SET value=excluded.value, cell_count=excluded.cell_count, cell_suppressed=excluded.cell_suppressed, updated_at=now()`. + - **No raw learner PII in Postgres** (D-031): only aggregates + opaque `learner_ref` for distinct counting. + - **7-day rolling window:** `window_start = today::date - 6`, `window_end = today::date`. + - Pre-defined 2-D views only (path × week, path × outcome) — no arbitrary filters (R-DASH-02 mitigation). +- **Acceptance criteria:** Aggregate upsert is idempotent (re-run produces same result). Cells with < 10 distinct learners are suppressed (cell_suppressed=TRUE, value=NULL). No raw PII in Postgres (only aggregates + opaque learner_ref). 7-day window computed correctly. + +#### TASK-07-02 — On-session-end async hook +- **Persona:** backend-engineer +- **File:** `server/cohort/hook.py` (new) +- **Content:** `async def on_session_end(pg_store: PgStore, session_outcome: dict) -> None` — calls `aggregator.aggregate_session`. Designed to be chained as an `asyncio.create_task` (fire-and-forget — D-054). Failures log + nightly job reconciles (no exception propagation to the caller). The hook is non-blocking — the session-end response returns immediately. If `pg_store` is None (no Postgres), no-op + log WARNING. +- **Acceptance criteria:** Hook is non-blocking (caller returns immediately). Hook failure logs but does not raise. No-Postgres → no-op + WARNING. Hook is idempotent (re-running with same session_outcome produces same aggregate). + +#### TASK-07-03 — Nightly reconciliation job +- **Persona:** backend-engineer +- **File:** `server/cohort/nightly.py` (new) +- **Content:** `class NightlyScheduler` — in-process asyncio scheduler (no APScheduler — RESEARCH-v0.4 §3.4). `async def start(self, pg_store)` — loops: compute seconds until next 03:00 CT → `asyncio.sleep(seconds)` → `await self._reconcile(pg_store)` → repeat. `async def _reconcile(self, pg_store)` — recomputes all 7-day windows for all paths (idempotent upsert). If the service restarts, the scheduler resumes on startup (computes next 03:00). Failures log + retry next night (R-DASH-04). The reconciliation guarantees REQ-NFR-DASH-02 (freshness ≤ 24h — the nightly job runs at least once/day). +- **Acceptance criteria:** Scheduler computes correct seconds until 03:00 CT. Reconciliation recomputes all windows (idempotent). Scheduler resumes after restart. Job failure logs + retries next night. Max staleness = 24h (nightly job + on-session-end hook — REQ-NFR-DASH-02). + +#### TASK-07-04 — Chain aggregation hook into session_recorder.py +- **Persona:** backend-engineer +- **File:** `server/session_recorder.py` (extend) +- **Content:** After the mastery flow (line ~143, `asyncio.create_task(self._run_mastery_flow_guarded(mastery_deps))`), chain the aggregation hook: `asyncio.create_task(self._run_cohort_aggregation(pg_store, session_outcome))`. The `session_outcome` dict is built from the mastery result (scenario_id, path, outcome, rubric_scores, failure_mode, branch_path, learner_ref=self.learner_id). The hook is fire-and-forget (D-054). If `pg_store` is None (no Postgres), skip. The hook runs in parallel with the mastery flow (aggregation only needs the session outcome + rubric scores, which are available after the session ends — it does not need to wait for mastery completion). **Off the voice path (C-8, D-054).** +- **Acceptance criteria:** Aggregation hook fires after session end. Voice loop latency unaffected (hook is async, non-blocking). Hook runs in parallel with mastery flow. No-Postgres → skip. session_recorder.py changes are backward-compatible (existing mastery flow unchanged). + +#### TASK-07-05 — Aggregation unit tests +- **Persona:** backend-engineer +- **File:** `tests/test_cohort_aggregation.py` (new) +- **Content:** Tests with mocked PgStore: + - k-anonymity suppression: 9 learners → cell_suppressed=TRUE, value=NULL. 10 learners → cell_suppressed=FALSE, value=computed. 11 learners → not suppressed. + - Idempotent upsert: same session_outcome twice → same aggregate. + - 7-day window computation: window_start/window_end correct. + - Multiple metrics: sessions_count, active_learners_count, gate_open_rate, etc. + - No PII: only aggregates + opaque learner_ref in upsert calls. +- **Acceptance criteria:** k-anon threshold exactly at 10 (9 suppressed, 10 not). Idempotent. All metrics computed correctly. No PII in any upsert call. + +#### TASK-07-06 — Nightly job + hook integration test +- **Persona:** backend-engineer +- **File:** `tests/test_cohort_nightly.py` (new) +- **Content:** Tests with mocked PgStore: + - Scheduler computes correct seconds until 03:00 CT (mock datetime). + - Reconciliation recomputes all windows (verify upsert calls for all paths × metrics). + - Hook failure → log + nightly job reconciles (simulate hook failure, run nightly, verify aggregate is correct). + - R-DASH-04: nightly job failure → logs + retries next night (mock failure, verify scheduler continues). +- **Acceptance criteria:** Scheduler timing correct. Reconciliation covers all paths. Hook failure + nightly reconciliation = correct final state. Nightly failure doesn't crash the scheduler. + +--- + +## SLICE-08: Operator API Cohort Endpoints (W1) + +- **Goal:** Implement the 4 auth-gated operator API endpoints for the cohort dashboard: practice volume, mastery progression, failure patterns, and credential management. +- **REQ-IDs covered:** REQ-DASH-01 (API layer — partial), REQ-NFR-DASH-01 (k-anon display — partial) +- **Wave:** 1 +- **Dependencies:** P1 SLICE-03 (current_operator dependency), P1 SLICE-01 (PgStore cohort_aggregates read) +- **Primary persona:** backend-engineer +- **Supporting personas:** data-engineer (k-anon query optimization) + +### Tasks + +#### TASK-08-01 — GET /api/operator/cohort (practice volume) +- **Persona:** backend-engineer +- **File:** `server/operator/cohort.py` (new) +- **Content:** `APIRouter` endpoint `GET /api/operator/cohort` with `dependencies=[Depends(current_operator)]` (D-057). Queries `cohort_aggregates` for practice volume metrics: sessions/day per path, total sessions in window, active learners (suppressed if < 10). Returns JSON: `{views: [{path, metrics: [{metric, window_start, window_end, value, cell_count, cell_suppressed, updated_at}]}], last_updated: "2026-08-04T03:00:00Z"}`. Suppressed cells have `value: null, cell_suppressed: true` — the frontend renders "— (<10 learners)" (D-053). No per-learner drill-down (R-DASH-02). +- **Acceptance criteria:** Auth-gated (401 without cookie). Returns k-anonymized data. Suppressed cells have value=null. `last_updated` = max(updated_at) across returned rows (freshness indicator — REQ-NFR-DASH-02). No per-learner data. + +#### TASK-08-02 — GET /api/operator/mastery (mastery progression) +- **Persona:** backend-engineer +- **File:** `server/operator/mastery.py` (new) +- **Content:** `GET /api/operator/mastery` — auth-gated. Returns mastery progression metrics: % learners at each week (1-6), gate-open rate, median mastery_score, rubric criterion mean scores. Same JSON shape as TASK-08-01. All cells k-anonymized (suppressed if < 10). +- **Acceptance criteria:** Auth-gated. Returns week distribution + gate-open rate + rubric criterion means. Suppressed cells have value=null. No per-learner data. + +#### TASK-08-03 — GET /api/operator/failure-patterns +- **Persona:** backend-engineer +- **File:** `server/operator/failure_patterns.py` (new) +- **Content:** `GET /api/operator/failure-patterns` — auth-gated. Returns failure pattern metrics: top failure_modes by frequency, rubric criteria with mean < 3.0 (weak-spots), branch outcome distribution (escalate vs accept). Same JSON shape. All k-anonymized. +- **Acceptance criteria:** Auth-gated. Returns failure_mode frequency + weak criteria + branch distribution. Suppressed cells have value=null. No per-learner data. + +#### TASK-08-04 — GET/POST /api/operator/credentials (VC management) +- **Persona:** backend-engineer +- **File:** `server/operator/credentials.py` (new) +- **Content:** `GET /api/operator/credentials` — auth-gated. Lists issued VCs from Postgres `issued_credentials` (operator's issuance log). Returns `[{id, learner_ref, vc_type, status, issued_at, revoked_at}]`. `POST /api/operator/credentials/{id}/revoke` — auth-gated. Revokes a VC (sets status='revoked', revoked_at=now()). Updates the Bitstring Status List. This is the operator-side credential management (D-057 — VC issuance endpoints are auth-gated). +- **Acceptance criteria:** Auth-gated. GET returns credential list (no PII beyond what the credential asserts — D-043). POST revoke → credential status='revoked'. Revoked credential fails verification (`GET /vc/verify/` → valid: false, status: revoked). + +#### TASK-08-05 — Endpoint unit tests +- **Persona:** backend-engineer +- **File:** `tests/test_operator_endpoints.py` (new) +- **Content:** Tests with mocked PgStore + mocked current_operator: + - All 4 endpoints return 401 without cookie. + - All 4 endpoints return 200 with valid cookie. + - Suppressed cells (cell_suppressed=TRUE) have value=null in response. + - `last_updated` is the max(updated_at) across rows. + - Credential revoke → status='revoked' in store + verification fails. + - No per-learner data in any response (R-DASH-02). +- **Acceptance criteria:** All endpoints auth-gated. Suppressed cells displayed correctly. Credential revoke works. No per-learner drill-down possible. + +--- + +## SLICE-09: React Cohort Dashboard + Router (W1) + +- **Goal:** Implement the React cohort dashboard UI: React Router for `/operator/*` routes, login form, dashboard with 3 k-anonymized views, inline SVG sparklines, auth gate. The SPA fallback in `__main__.py` is in SLICE-10 (integration). +- **REQ-IDs covered:** REQ-DASH-01 (UI layer — partial), REQ-NFR-DASH-01 (display suppressed cells — partial) +- **Wave:** 1 +- **Dependencies:** P1 SLICE-03 (auth API contract: POST /login, GET /me), SLICE-08 (API contract: cohort/mastery/failure-patterns response shapes — implements against contract, not live API) +- **Primary persona:** frontend-engineer +- **Supporting personas:** backend-engineer (SPA fallback in SLICE-10, API contract consultation) + +### Tasks + +#### TASK-09-01 — Add react-router-dom to client/package.json +- **Persona:** frontend-engineer +- **File:** `client/package.json` (extend) +- **Content:** Add `react-router-dom@^7` to dependencies. Run `npm install`. No chart library (inline SVG sparklines — zero deps, RESEARCH-v0.4 §4.3). +- **Acceptance criteria:** `npm install` succeeds. `npm run build` succeeds. `react-router-dom` in `node_modules`. Bundle size increase is reasonable (< 20KB for react-router-dom). + +#### TASK-09-02 — BrowserRouter wrapper + route switch in App.tsx +- **Persona:** frontend-engineer +- **File:** `client/src/main.tsx` (extend), `client/src/App.tsx` (extend) +- **Content:** Wrap `App` in ``. In `App.tsx`, add ``: + - `/` → existing voice session UI (start→live→debrief — unchanged) + - `/operator/login` → `Login` component + - `/operator/dashboard` → `Dashboard` component (auth-gated) + - `*` (catch-all) → voice session UI (fallback for unknown routes — SPA fallback) + - R-DASH-05 mitigation: the existing voice UI at `/` is unchanged. The catch-all route serves the voice UI, not a 404. +- **Acceptance criteria:** Voice UI at `/` works exactly as before (R-DASH-05). `/operator/login` renders login form. `/operator/dashboard` renders dashboard (or redirects to login). `npm run build` succeeds. No regressions in voice UI. + +#### TASK-09-03 — Login form component +- **Persona:** frontend-engineer +- **File:** `client/src/operator/Login.tsx` (new) +- **Content:** Login form: username + password fields + submit button. `POST /api/operator/login` on submit. On success → navigate to `/operator/dashboard`. On failure → show error. On 429 → show "Too many attempts, try again in a minute." Minimal CSS (reuse App.css patterns — no Tailwind/bootstrap). Form is accessible (label associations, keyboard navigation). +- **Acceptance criteria:** Login form renders. Successful login navigates to dashboard. Failed login shows error. Rate limit (429) shows retry message. Form is keyboard-accessible. + +#### TASK-09-04 — Dashboard shell + auth gate +- **Persona:** frontend-engineer +- **File:** `client/src/operator/Dashboard.tsx` (new) +- **Content:** Dashboard shell: on mount, `GET /api/operator/me` → if 401, redirect to `/operator/login` (D-057 — React route guard, UX only). If 200, render dashboard with: operator name in header, 3 view tabs (Practice Volume, Mastery Progression, Failure Patterns), freshness indicator ("Last updated: Xh ago" from `last_updated` in API response — REQ-NFR-DASH-02), logout button (POST /api/operator/logout → redirect to login). View content fetched from respective `/api/operator/` endpoints. +- **Acceptance criteria:** Auth gate redirects to login on 401. Dashboard renders operator name. 3 view tabs switch. Freshness indicator shows "Last updated: Xh ago". Logout redirects to login. No PII displayed (only k-anonymized aggregates — D-031). + +#### TASK-09-05 — Inline SVG sparkline component +- **Persona:** frontend-engineer +- **File:** `client/src/operator/Sparkline.tsx` (new) +- **Content:** `` — renders an SVG polyline from the data array. ~50 LOC, zero deps (RESEARCH-v0.4 §4.3). Handles edge cases: empty data (renders nothing), single point (renders a dot), all-same values (renders a flat line). Color: stroke=currentColor (inherits from parent). No axes, no tooltips (sparklines are compact trend indicators, not full charts). +- **Acceptance criteria:** Renders SVG polyline for 7-30 data points. Empty data → no render. Single point → dot. All-same → flat line. No external deps. ~50 LOC. + +#### TASK-09-06 — 3 dashboard view components +- **Persona:** frontend-engineer +- **Files:** `client/src/operator/views/PracticeVolume.tsx` (new), `client/src/operator/views/MasteryProgression.tsx` (new), `client/src/operator/views/FailurePatterns.tsx` (new) +- **Content:** Each view: fetches its `/api/operator/` endpoint, renders read-only tables + sparklines. + - **PracticeVolume:** sessions/day per path (table + sparkline), total sessions, active learners. Suppressed cells → "— (<10 learners)" (REQ-NFR-DASH-01 display). + - **MasteryProgression:** % learners at each week (bar-like table), gate-open rate, median mastery_score, rubric criterion means (table + sparkline). Suppressed cells → "— (<10 learners)". + - **FailurePatterns:** top failure_modes by frequency (sorted table), rubric criteria with mean < 3.0 (highlighted as weak-spots), branch outcome distribution. Suppressed cells → "— (<10 learners)". + - All views: loading state, error state, no-data state. Read-only (no filters, no drill-down — R-DASH-02). +- **Acceptance criteria:** Each view fetches + renders k-anonymized data. Suppressed cells display "— (<10 learners)". Tables are read-only. Sparklines render in table rows. Loading/error/no-data states handled. No per-learner drill-down. + +#### TASK-09-07 — Dashboard unit tests +- **Persona:** frontend-engineer +- **File:** `client/src/operator/__tests__/Dashboard.test.tsx` (new — or co-located per project convention) +- **Content:** Tests: + - Auth gate: 401 on /me → redirect to /operator/login. + - Login form: submit → POST /login → navigate to dashboard. + - Suppressed cell display: cell_suppressed=true → "— (<10 learners)" rendered. + - Sparkline: renders SVG polyline for given data. + - Freshness indicator: "Last updated: Xh ago" computed from last_updated. + - No PII: only aggregate values in rendered DOM. +- **Acceptance criteria:** All tests pass. Auth gate works. Suppressed cells display correctly. Sparkline renders. No PII in DOM. + +--- + +## SLICE-10: P2 Integration (W2) + +- **Goal:** Wire P2 modules into `server/__main__.py`: SPA fallback catch-all route (before StaticFiles), operator API router mount (cohort/mastery/failure-patterns/credentials), nightly scheduler start. Run end-to-end aggregation→endpoint→dashboard integration tests. +- **REQ-IDs covered:** REQ-DASH-01 (full integration), REQ-NFR-DASH-01 (k-anon e2e), REQ-NFR-DASH-02 (freshness e2e), REQ-MT-02 (pipeline e2e) +- **Wave:** 2 +- **Dependencies:** SLICE-07 (aggregation pipeline), SLICE-08 (operator endpoints), SLICE-09 (React dashboard) +- **Primary persona:** backend-engineer +- **Supporting personas:** lead-developer (integration orchestration), frontend-engineer (SPA fallback verification) + +### Tasks + +#### TASK-10-01 — __main__.py — SPA fallback catch-all route +- **Persona:** backend-engineer +- **File:** `server/__main__.py` (extend) +- **Content:** Add a catch-all route BEFORE the StaticFiles mount: `@app.get("/{path:path}")` that returns `FileResponse("client/dist/index.html")` for any path not matching an API route (`/health`, `/pipecat/*`, `/vc/*`, `/api/operator/*`). This is the SPA fallback for React Router `/operator/*` routes (R-DASH-03). **R-DASH-03 mitigation: the catch-all is BEFORE the StaticFiles mount, and the existing API routes are registered before the catch-all.** The StaticFiles mount remains for serving JS/CSS/assets (the catch-all only serves index.html for client-side routes). Test: `/` still serves the voice UI (index.html, which loads the voice app); `/operator/dashboard` serves index.html (React Router handles the route client-side); `/api/operator/cohort` still returns JSON (not index.html). +- **Acceptance criteria:** `GET /` → index.html (voice UI loads). `GET /operator/dashboard` → index.html (React Router handles it). `GET /operator/login` → index.html. `GET /api/operator/cohort` → JSON (not index.html — API routes take precedence). `GET /health` → JSON. `GET /vc/verify/123` → JSON. `GET /static.js` → served by StaticFiles (not the catch-all). R-DASH-03 verified: voice UI at `/` unchanged. + +#### TASK-10-02 — __main__.py — mount operator API router + nightly scheduler +- **Persona:** backend-engineer +- **File:** `server/__main__.py` (extend) +- **Content:** `from server.operator.cohort import router as cohort_router`, `from server.operator.mastery import router as mastery_router`, `from server.operator.failure_patterns import router as failure_router`, `from server.operator.credentials import router as credentials_router`. `app.include_router(...)` for each. All use `prefix="/api/operator"` + `dependencies=[Depends(current_operator)]` (auth-gated — D-057). Mount BEFORE the SPA fallback catch-all. Start the nightly scheduler in the lifespan: `asyncio.create_task(nightly_scheduler.start(pg_store))` (if pg_store available). Cancel the scheduler task on shutdown. +- **Acceptance criteria:** `GET /api/operator/cohort` with valid cookie → JSON. Without cookie → 401. Nightly scheduler starts on app startup (if Postgres). Scheduler cancelled on shutdown. API routes matched before SPA fallback. + +#### TASK-10-03 — P2 integration test (aggregation → endpoint → response) +- **Persona:** backend-engineer +- **File:** `tests/test_p2_aggregation_integration.py` (new — requires Postgres, skip if no DSN) +- **Content:** End-to-end: + 1. Seed 15 mock sessions (12 distinct learners — above k-anon threshold) for a path. + 2. Run the aggregation hook for each session → `cohort_aggregates` populated. + 3. `GET /api/operator/cohort` (with auth cookie) → returns practice volume with non-suppressed cells (12 ≥ 10). + 4. Seed 5 more sessions from 5 NEW distinct learners for a different path → `GET /api/operator/cohort` for that path → suppressed cells (5 < 10, value=null, cell_suppressed=true). REQ-NFR-DASH-01 verified. + 5. Run nightly reconciliation → all windows recomputed → `last_updated` updated. + 6. `GET /api/operator/mastery` → mastery progression data. + 7. `GET /api/operator/failure-patterns` → failure pattern data. + 8. Verify `last_updated` in response ≤ 24h old (REQ-NFR-DASH-02). +- **Acceptance criteria:** k-anon threshold enforced (12 learners → not suppressed, 5 → suppressed). All 3 endpoints return k-anonymized data. Nightly reconciliation updates `last_updated`. Freshness ≤ 24h (REQ-NFR-DASH-02). No per-learner data in any response. + +#### TASK-10-04 — P2 integration test (SPA fallback + voice UI coexist) +- **Persona:** backend-engineer +- **File:** `tests/test_p2_spa_fallback.py` (new) +- **Content:** Tests against the running server (or TestClient): + 1. `GET /` → 200, `content-type: text/html`, contains `
` (voice UI loads). + 2. `GET /operator/dashboard` → 200, `content-type: text/html`, contains `
` (SPA fallback serves index.html). + 3. `GET /operator/login` → 200, `text/html` (SPA fallback). + 4. `GET /api/operator/cohort` → JSON (API route, not SPA fallback). + 5. `GET /health` → JSON (API route). + 6. `GET /pipecat/webrtc` → 405 (method not allowed — POST only, but route exists, not SPA fallback). + 7. `GET /vc/verify/nonexistent` → 404 (API route, not SPA fallback). + 8. `GET /assets/index.js` → served by StaticFiles (not SPA fallback). + **R-DASH-03 verified: SPA fallback serves index.html for client-side routes; API routes + StaticFiles assets are unaffected.** +- **Acceptance criteria:** All 8 assertions pass. R-DASH-03 verified: voice UI at `/` unchanged, operator routes serve index.html, API routes return JSON, assets served by StaticFiles. + +#### TASK-10-05 — P2 verification matrix +- **Persona:** lead-developer +- **File:** `.ciagent/VERIFY-P2.md` (new — pre-verify checklist for the verify stage) +- **Content:** REQ-ID → test mapping for P2. Confirm all P2 REQ-IDs (REQ-DASH-01, REQ-NFR-DASH-01, REQ-NFR-DASH-02, REQ-MT-02) have covering tests. List each test file + what it verifies. Cross-reference with P1 VERIFY (if any). +- **Acceptance criteria:** Every P2 REQ-ID has at least one covering test listed. Matrix is complete (no gaps). + +--- + +# Final Phase (P3) — Review + Audit + Milestone Ship + +**Branch:** `phase/03-final-review-ship` → merged to `milestone/v0.4-operator-tier` → merged to `main` +**Ship:** `v0.1.9` (final patch = v0.4 milestone release) +**REQ-IDs covered:** all v0.4 REQ-IDs (milestone-complete verification) + +### Tasks (delegated to ciagent-review + ciagent-audit + ciagent-ship) + +1. Run branch gate → create `phase/03-final-review-ship` +2. `ciagent-review` — multi-persona review across P1 + P2; auto-apply P0 fixes, flag P1+ + - **Security-engineer review focus:** auth stack (argon2id, cookies, rate limit), VC key migration (R-VC-MIG-01), R-AUTH-01 (Secure cookie + no-TLS — config-driven flag documented in GRILL-v0.4.md) + - **Data-engineer review focus:** k-anonymity suppression (write-time, ≥10 threshold), no PII in Postgres, no cross-DB joins + - **Frontend-engineer review focus:** auth gate (UX-only, server is authority), suppressed cell display, SPA fallback (R-DASH-03) +3. `ciagent-audit` — reconstruction test, file discipline, branch hygiene, commit discipline +4. `ciagent-ship` — merge phase/03 → milestone/v0.4-operator-tier → main; tag v0.1.9; create release with full milestone summary +5. Update REQUIREMENTS.md (all v0.4 REQ → complete), ROADMAP.md (v0.4 → complete; v0.5 = Live Assist) +6. Commit: `docs(milestone): complete v0.4-operator-tier` +7. Clear checkpoint + +--- + +# REQ-ID Coverage Matrix + +| REQ-ID | Phase | Slice(s) | Coverage | +|--------|-------|----------|----------| +| REQ-MT-01 | P1 | SLICE-01, SLICE-06 | Postgres store (5 tables) + pool + migration runner + integration | +| REQ-MT-02 | P1 (schema) + P2 (pipeline) | SLICE-01 (schema), SLICE-07 (pipeline), SLICE-10 (e2e) | Cohort aggregation pipeline — schema in P1, hook + nightly + k-anon in P2 | +| REQ-AUTH-01 | P1 | SLICE-03, SLICE-05, SLICE-06 | Operator auth (argon2id + cookies + rate limit) + bootstrap CLI + integration | +| REQ-DASH-01 | P2 | SLICE-08, SLICE-09, SLICE-10 | Cohort dashboard — API endpoints + React UI + integration | +| REQ-NFR-AUTH-01 | P1 | SLICE-03, SLICE-06 | argon2id + httpOnly + secure + SameSite=Strict + rate-limited + 8h expiry | +| REQ-NFR-MT-01 | P1 | SLICE-01, SLICE-02, SLICE-06 | Postgres-in-LXC (second service, internal network, 6GB CT, backup) + learner service coexist test | +| REQ-NFR-DASH-01 | P2 | SLICE-07, SLICE-08, SLICE-09, SLICE-10 | k-anonymity ≥ 10 (write-time suppression + query + display + e2e test) | +| REQ-NFR-DASH-02 | P2 | SLICE-07, SLICE-10 | Freshness ≤ 24h (nightly job + on-session-end hook + e2e test) | + +**v0.4 total: 8/8 REQ-IDs covered (4 functional + 4 NFR). 0 partial. 0 deferred within v0.4.** + +--- + +# Risk Mitigation Matrix + +| Risk ID | Severity | Slice(s) | Mitigation | +|---------|----------|----------|------------| +| **R-VC-MIG-01** | high | SLICE-04, SLICE-06 | Archive v0.3 public key as superseded BEFORE activating new key; verification queries by key_id (not status); e2e test verifies v0.3 VC against Postgres store | +| R-MT-01 | medium | SLICE-02, SLICE-07 | CT memory bump 6GB; nightly jobs at 03:00 CT (low activity); aggregation is incremental upsert (not full scan) | +| R-MT-02 | medium | SLICE-01 | pg_isready healthcheck + 5 retries; depends_on: service_healthy; pg_migrate retries on connection failure (3x, 2s backoff) | +| R-AUTH-01 | medium | SLICE-03 | Config-driven PRAXIS_COOKIE_SECURE (default true; false for HTTP pilot with logged WARNING); cohort dashboard reads only k-anonymized aggregates (no PII leak even if cookie sniffed); grill must sign off | +| R-DASH-01 | medium | SLICE-07, SLICE-09 | Write-time suppression (cell_suppressed=TRUE, value=NULL); dashboard shows "— (<10 learners)" transparently; 7-day window can be widened to 14-day if too many cells suppressed | +| R-DASH-02 | medium | SLICE-07, SLICE-08 | Pre-defined 2-D views only (path × week, path × outcome); no arbitrary filters; no per-learner drill-down (D-053) | +| R-DASH-03 | medium | SLICE-10 | Catch-all route BEFORE StaticFiles mount; test `/` still serves voice UI; test `/operator/dashboard` serves index.html; test API routes return JSON (not index.html) | +| R-DASH-05 | medium | SLICE-09 | BrowserRouter wrapper + catch-all route serves voice UI at `/`; test voice UI unchanged after Router addition | +| R-VC-MIG-02 | medium | SLICE-04 | v0.3 private key NOT migrated (only public key archived); v0.4 active key generated fresh with v0.4 root key; v0.3 root key kept in secrets until v0.3 VCs expire | +| R-VC-MIG-03 | medium | SLICE-04, SLICE-06 | IssuerKeyStore protocol/ABC; both PraxisStore and PgStore implement it; e2e test verifies v0.3 VC against Postgres store with archived key | +| R-MT-03 | low | SLICE-01 | Network change (default bridge → praxis-net) recreates praxis container (~5-15s downtime); SQLite volume untouched → learner state preserved; documented in compose comments | +| R-MT-04 | low | SLICE-02 | Named volumes stable on Docker-in-LXC with nesting=1; nightly pg_dump provides backup; restore drill documented | +| R-MT-05 | low | SLICE-01 | Verified: gen_random_uuid() is PG13+ core (no extension). PG16 confirmed | +| R-AUTH-02 | low | SLICE-03 | Single operator login is low-frequency; ~80ms argon2id is acceptable on event loop. Not a v0.4 concern | +| R-AUTH-03 | low | SLICE-03 | In-memory rate limit lost on restart (single-instance pilot; restarts are rare + operator-initiated). Documented as accepted pilot risk | +| R-AUTH-04 | low | SLICE-03 | Cookie secret rotation invalidates all sessions (pilot: acceptable — one operator re-logs in). Documented | +| R-AUTH-05 | low | SLICE-03 | No server-side session revocation (D-056 explicit — stateless cookies). Forced-logout = cookie secret rotation. Deferred | +| R-DASH-04 | low | SLICE-07 | Nightly job failure → logs + retries next night; on-session-end hook keeps data fresh in the meantime | +| R-BOOT-01 | low | SLICE-05 | create-operator.py retries on connection failure (3 attempts, 5s backoff); run after postgres healthcheck passes | +| R-BOOT-02 | low | SLICE-05 | Script checks env var presence + exits with clear error if missing. Documented in .env.example | + +**Coverage: 1/1 high risk + 9/9 medium risks + 11/11 low risks addressed. 20/20 total.** + +--- + +# Open Questions Deferred to EXECUTE + +1. **v0.3 issued_credentials migration:** The verification endpoint needs to find v0.3 credentials (in SQLite) AND v0.4 credentials (in Postgres). SLICE-04 TASK-04-04 implements a try-Postgres-first-fall-back-to-SQLite approach. Alternative: migrate v0.3 credential rows to Postgres (data migration, not re-signing). The executor should choose the simpler approach — the fallback-to-SQLite is simpler (no data migration) but means the verification endpoint queries two stores. Confirm in SLICE-04/SLICE-06. + +2. **SPA fallback implementation:** Catch-all route (`@app.get("/{path:path}")`) before StaticFiles, or a custom StaticFiles subclass that returns index.html for non-file paths? SLICE-10 TASK-10-01 uses the catch-all route (simpler). The executor should verify the catch-all doesn't shadow StaticFiles asset serving (JS/CSS files). The test in TASK-10-04 verifies this. + +3. **Cohort aggregation `learner_ref` source:** The existing `HARDCODED_LEARNER_ID = "learner-1"` (db/store.py:29). For v0.4 (single learner), k-anonymity will suppress everything (1 < 10). This is expected at pilot scale (R-DASH-01). The aggregation pipeline groups by `learner_ref` so k-anon counts distinct learners. Multi-learner-per-device is deferred. Confirm the dashboard shows "— (suppressed, <10 learners)" for all cells in the single-learner pilot. The executor should seed test data with ≥10 mock learners to verify the non-suppressed path. + +4. **Nightly scheduler timezone:** 03:00 CT (Central Time — Canada pilot is CT?). The scheduler uses `datetime.now()` with a timezone-aware approach. The executor should use `zoneinfo.ZoneInfo("America/Winnipeg")` or similar for CT. Confirm in SLICE-07 TASK-07-03. + +5. **`create-operator.py` `--update` flag:** SLICE-05 TASK-05-01 includes a `--update` flag for force-rehash. The executor should decide if this is a positional arg or a `--update` flag. Keep it simple: `--update` flag. + +6. **Cookie `path` scope:** RESEARCH-v0.4 §open-questions #5 recommends `path="/"` (cookie sent to all routes) so the React `/operator/*` routes can call `/api/operator/me` on mount. SLICE-03 TASK-03-02 uses `path="/"`. Confirm. + +7. **Aggregation hook parallel vs sequential with mastery flow:** SLICE-07 TASK-07-04 chains the aggregation hook in parallel with the mastery flow (both are `asyncio.create_task`). The aggregation only needs the session outcome (available after session end), not the mastery scoring result. However, some metrics (rubric criterion means) need the rubric scores from the mastery flow. The executor should decide: chain the aggregation AFTER mastery completion (sequential) or run in parallel and have the nightly job fill in rubric-dependent metrics. Recommendation: run in parallel + nightly job reconciles rubric-dependent metrics (simpler, freshness ≤ 24h guaranteed by nightly). + +--- + +# Summary + +| Metric | Value | +|--------|-------| +| Execution phases | 2 (P1: operator foundation, P2: cohort dashboard) + 1 final (P3: review + ship) | +| Slices | 10 (6 in P1, 4 in P2) | +| Tasks | 52 (29 in P1, 23 in P2) | +| REQ-IDs covered | 8/8 (REQ-MT-01, REQ-MT-02, REQ-AUTH-01, REQ-DASH-01, REQ-NFR-AUTH-01, REQ-NFR-MT-01, REQ-NFR-DASH-01, REQ-NFR-DASH-02) | +| Risks addressed | 20/20 (1 high, 9 medium, 11 low) | +| Waves | P1: 3 waves (2+3+1 parallel slots), P2: 2 waves (3+1 parallel slots) | +| Max parallelism | 3 slices per wave (within 5-agent limit) | +| Personas active | 6 (lead-developer, backend-engineer, frontend-engineer, data-engineer, security-engineer, devops-engineer) | +| New pip deps | 3 (asyncpg, argon2-cffi, slowapi) | +| New npm deps | 1 (react-router-dom@^7) | +| Ship targets | v0.1.7 (P1), v0.1.8 (P2), v0.1.9 (P3 = v0.4 milestone release) | \ No newline at end of file diff --git a/.ciagent/PROJECT.md b/.ciagent/PROJECT.md index 99ac9f9..ed40088 100644 --- a/.ciagent/PROJECT.md +++ b/.ciagent/PROJECT.md @@ -1,9 +1,9 @@ # Praxis — Voice-first AI Apprenticeship Platform -**Milestone:** v0.3 (Mastery scoring + competency rubrics) +**Milestone:** v0.4 (Operator tier — cohort dashboard, auth, Postgres) **Status:** phase 0 — specify (active milestone) **Autonomy:** full -**Previous milestone:** v0.2 (Proxmox LXC deployment) — complete, tagged v0.1.2, release #377 +**Previous milestone:** v0.3 (Mastery scoring + competency rubrics + verifiable credentials) — complete, tagged v0.1.5, release #380 ## Vision @@ -15,9 +15,9 @@ Praxis is a voice-first, AI-tutored skill platform for learners in resource-cons Build a voice-first AI apprenticeship platform where learners engage in spoken role-play scenarios with AI tutors, receive coaching debriefs, and progress via mastery gates — working on low-cost phones over constrained bandwidth. -## v0.3 Scope (Mastery Scoring + Competency Rubrics) +## v0.3 Scope (Mastery Scoring + Competency Rubrics — complete, retained for context) -v0.3 activates the mastery/assessment layer deferred from v0.1/v0.2 (per D-021, ROADMAP line 53). Learners progress via **mastery gates** — they move on only when they can do the thing across varied scenarios, scored against a competency rubric. v0.3 also introduces the multi-tenant + auth foundation required for the cohort dashboard, and a verifiable-credential issuer so mastery is portable. +v0.3 activated the mastery/assessment layer deferred from v0.1/v0.2 (per D-021, ROADMAP line 53). Learners progress via **mastery gates** — they move on only when they can do the thing across varied scenarios, scored against a competency rubric. v0.3 introduced a verifiable-credential issuer so mastery is portable. The operator tier (multi-tenant + auth + cohort dashboard) was deferred to v0.4 per GRILL-v0.3.md Axis 2. **v0.3 in scope (activated REQ groups — post-grill):** - **Mastery core (REQ-MAST-01, REQ-MAST-02):** competency rubric per skill; Mastery Score updated after each session, requiring varied-scenario success before a mastery gate opens @@ -42,9 +42,40 @@ v0.3 activates the mastery/assessment layer deferred from v0.1/v0.2 (per D-021, - Voice loop (Deepgram Nova-3 + Cartesia + Pipecat + Ollama Cloud) - v0.1 scenario (`cs_refund_ca_v01.yaml`) + guardrails + debrief -## v0.2 Scope (Proxmox LXC Deployment — complete) +## v0.4 Scope (Operator Tier — Cohort Dashboard + Auth + Postgres) -v0.2 deploys praxis into a Proxmox LXC container, reusing and adapting the battle-tested deployment toolkit from `~/coreci/scripts/proxmox/`. The v0.1 voice loop becomes deployable infrastructure — a Docker image runs the Python/Pipecat server (serving the React client as static files) inside an LXC container on the operator's Proxmox cluster. +v0.4 activates the operator tier deferred from v0.3 per GRILL-v0.3.md Axis 2 (the operator tier was originally v0.8 on this ROADMAP; pulling it into v0.3 created a 2-milestone program disguised as one). The v0.3 mastery/VC/scenario work carries forward unchanged; v0.4 layers the operator surface on top of it. + +**v0.4 in scope (activated REQ groups — 8 REQs total):** +- **Operator-tier Postgres (REQ-MT-01):** second Docker service in the existing LXC CT (`docker-compose.yml` adds `postgres`), Postgres 16, persistent volume, internal Docker network only (D-040). Separate from learner-local SQLite (D-007 preserved for learner surface). Stores cohort aggregations, operator accounts, issued credentials, mastery-gate audit log. +- **Cohort aggregation pipeline (REQ-MT-02):** on-session-end hook + nightly reconciliation job writes k-anonymized aggregates to Postgres from learner sessions (D-045). No raw learner PII in Postgres. +- **Operator auth (REQ-AUTH-01):** session-cookie, argon2id passwords, single `operator` role, login rate-limited (5 attempts/min) (D-041). Cookie: httpOnly, secure, SameSite=Strict, 8h expiry. Protects cohort dashboard + credential issuance. +- **Cohort dashboard (REQ-DASH-01):** anonymized cohort view (practice, mastery progression, failure patterns) for training operators — k-anonymity ≥ 10, 7-day aggregation window (D-034). React route under `/operator/*`, served by the same FastAPI server (new `/api/operator/*` prefix), reuses v0.2 StaticFiles (D-044). No separate SPA build — same `client/dist`. +- **NFRs (4):** REQ-NFR-AUTH-01 (argon2id + httpOnly + secure + rate-limited), REQ-NFR-MT-01 (Postgres-in-LXC without destabilizing learner service), REQ-NFR-DASH-01 (k-anonymity ≥ 10 enforced — cells < 10 suppressed), REQ-NFR-DASH-02 (freshness ≤ 24h stale). + +**v0.4 out of scope (still deferred):** +- REQ-PATH-01 (full multi-path launch) — v0.3 ships Customer Service path only, multi-path later +- REQ-DASH-02 (full operator-suite dashboard) — later milestone (v0.4 ships the foundational cohort view only) +- REQ-ASSIST-01..03 (Live Assist) — later milestone +- REQ-LOWBW-01..03 (WhatsApp/USSD/offline) — later milestone +- REQ-VOICE-05/06 (multi-language, persona switching) — later milestone +- Learner auth / multi-learner-per-device — operator auth is v0.4; learner auth later +- RBAC (multiple operator roles) — single `operator` role in v0.4; RBAC deferred +- Third-party credential issuers — v0.9 credentialing milestone +- Differential privacy — k-anonymity ≥ 10 is sufficient for v0.4 scale (D-034) + +**Carries forward from v0.3 (already in production):** +- Mastery scoring + competency rubrics + IRT dynamic difficulty (v0.3) +- Verifiable credential issuer (W3C VC 2.0, Ed25519, SQLite-backed) — v0.4 migrates the issuer key store to operator-tier Postgres + secrets (D-042) +- Scenario library + Customer Service 6-week path (v0.3) +- Docker-in-LXC deployment (v0.2) +- Voice loop (Deepgram Nova-3 + Cartesia + Pipecat + Ollama Cloud) (v0.1) + +## v0.3 Scope (Mastery Scoring + Competency Rubrics — complete) + +v0.3 activated the mastery/assessment layer deferred from v0.1/v0.2 (per D-021). Learners progressed via mastery gates — they moved on only when they could do the thing across varied scenarios, scored against a competency rubric. v0.3 shipped competency rubric engine + Mastery Score + scenario library (≥6 CS scenarios) + dynamic difficulty (IRT) + Customer Service 6-week path + verifiable-credential issuer (W3C VC 2.0, Ed25519, SQLite-backed, formative-tier, public verification). All learner-facing. Released as v0.1.5. + +## v0.2 Scope (Proxmox LXC Deployment — complete) **v0.2 in scope:** - Docker image (multi-stage: Node builds `client/dist`, Python runs `server` + serves dist via FastAPI StaticFiles) @@ -146,6 +177,14 @@ v0.2 deploys praxis into a Proxmox LXC container, reusing and adapting the battl | D-047 | Scenario library minimum for v0.3 = **≥6 expert-authored Customer Service scenarios** (one per path week) + **AI-generated variations gated by expert review** | REQ-SCEN-03/04. 6 scenarios give the mastery gate's N=3 varied-scenario condition room (D-032) without being so few that mastery is gameable. AI variations: LLM generates a variation from an expert scenario's schema with `generated_from` backref; expert reviews + approves before it enters the library. | 0.70 | 3 scenarios (mastery gate N=3 = exactly the minimum — no room for failure-retry variety), 12 scenarios (over-scoped for one milestone), no AI variations (loses REQ-SCEN-04) | | D-048 | Mastery gate open action = **advance learner to next path week + issue VC if week-final gate** | When D-032 condition met for a week's scenarios: learner `progress.current_week` advances. If the gate is the final week's gate, a VC is issued (REQ-MAST-03) asserting mastery of the path. Mid-path gates: no VC, just advancement. VCs are path-level, not week-level. | 0.75 | VC per week (credential spam — devalues the credential), no advancement (mastery gate is decorative), manual advancement (violates autonomy) | | D-049 | v0.3 activation of D-009 failure-injection = **NO** — failure-injection stays architecturally present but not provoked in v0.3 | D-009 hook stays in the schema. v0.3 mastery scoring scores *recovery* from naturally-occurring failure branches (the `escalate` branch in cs_refund_ca_v01), not AI-provoked failures. Active failure injection couples to a "failure-recovery coaching" feature that's a later milestone. v0.3 RESEARCH confirms this — no new failure-injection scenarios authored. | 0.80 | Activate failure injection in v0.3 (couples mastery scoring to a new feature — scope creep), remove the hook (breaks forward compat) | +| D-050 | Postgres connection from praxis service = **asyncpg pool over Docker internal network, service DNS name `postgres`** | CLARIFY auto-decide (full autonomy). docker-compose defines a `postgres` service on an internal bridge network; the praxis service reaches it via `postgresql://praxis:${PRAXIS_PG_PASSWORD}@postgres:5432/praxis`. asyncpg is the async Pg driver (matches FastAPI async). No external port exposure. Single connection pool (min 1, max 10 — v0.4 scale). | 0.85 | psycopg2 sync (blocks event loop), external port + host access (security surface), pgbouncer (over-provisioned for v0.4 scale) | +| D-051 | VC issuer key migration = **fresh keypair on first v0.4 boot; v0.3 SQLite-issued VCs remain verifiable via archived public key** | CLARIFY auto-decide. v0.3 stored the Ed25519 issuer key in SQLite (`issuer_keys` table). v0.4 generates a fresh keypair in Postgres `issuer_keys` (D-040), marks it `active`, and archives the v0.3 public key as `superseded` (not revoked — old VCs still verify against it). The verification endpoint tries the active key first, falls back to superseded keys for older credentials. No re-issuance of v0.3 VCs. | 0.80 | Re-issue all v0.3 VCs (unnecessary churn, learners hold old credentials), revoke v0.3 key (breaks old VCs), keep SQLite key store (defeats D-031 hybrid) | +| D-052 | Operator account bootstrap = **first-run CLI script `scripts/create-operator.py` creates the initial operator from env-provided credentials** | CLARIFY auto-decide. No signup UI (operators are provisioned, not self-serve). Script reads `PRAXIS_BOOTSTRAP_OPERATOR_USER` + `PRAXIS_BOOTSTRAP_OPERATOR_PASS` from `.env.secrets`, hashes the password with argon2id, inserts into `operators` table. Idempotent (no-op if user exists). Subsequent operators added via the same script (run by the operator from the host). RBAC deferred (D-041 single role). | 0.80 | First-run web wizard (UI surface for a one-time action), hardcoded admin/admin (insecure), SQL insert (no password hashing) | +| D-053 | Cohort dashboard v0.4 scope = **3 views: practice-volume, mastery-progression, failure-patterns — all k-anonymized ≥10, 7-day rolling windows** | CLARIFY auto-decide. REQ-DASH-01 names "practice, mastery progression, failure patterns" — v0.4 implements exactly those three views, no more. (1) Practice volume: sessions/day per path, anonymized. (2) Mastery progression: % learners at each week, gate-open rate. (3) Failure patterns: top failure modes by frequency, rubric criterion weak-spots. Each view = a `/api/operator/` endpoint returning pre-aggregated rows from `cohort_aggregates`; React renders read-only tables + sparkline charts. No filters beyond path + window (no per-learner drill-down — k-anon). | 0.80 | Full BI dashboard (over-scoped for v0.4), single combined view (loses the three named aspects), per-learner drill-down (violates k-anon) | +| D-054 | Aggregation trigger = **async fire-and-forget on session end (non-blocking); nightly reconciliation job at 03:00 CT** | CLARIFY auto-decide. D-045 named the trigger; this clarifies the semantics. On `end_session()`, the server enqueues an aggregation task to an in-process `asyncio.Task` (no Celery/Redis for v0.4 scale) — non-blocking, the session-end response returns immediately. Failures log + the nightly job reconciles (idempotent upsert by window). Nightly job: cron-style `asyncio.create_task` loop, recomputes all 7-day windows. If the service restarts, the in-flight task is lost but nightly reconciliation covers it. | 0.80 | Sync on session-end (adds latency to learner path — violates C-8), Celery+Redis (over-provisioned), CDC streaming (over-engineered) | +| D-055 | Postgres backup = **nightly `pg_dump` to a named Docker volume, 7-day retention** | CLARIFY auto-decide. Postgres data lives on a named Docker volume (`pgdata`) inside the LXC CT. Nightly cron job runs `pg_dump praxis | gzip > /backups/praxis-$(date).sql.gz` to a second named volume (`pgbackups`). 7-day retention (rotates oldest). Operator can `pct pull` backups to the PVE host. No streaming replication (single CT, no replica target). This is pilot-tier backup; a later milestone adds off-CT replication. | 0.70 | No backups (data loss risk), WAL streaming to a replica (no replica in v0.4), S3 push (no S3 in LXC pilot) | +| D-056 | Auth session store = **signed stateless cookies (HMAC-SHA256), no server-side session table** | CLARIFY auto-decide. D-041 said "session-cookie" — clarifying: the cookie is a self-contained signed token (user_id, issued_at, expiry, HMAC). No `sessions` table in Postgres. Verification = recompute HMAC + check expiry. Logout = client clears cookie (stateless — no server revocation list in v0.4). Rate limit is in-memory (single-instance). This minimizes DB load + simplifies the auth surface. A later milestone adds a revocation list if multi-instance or forced-logout is needed. | 0.75 | Postgres sessions table (DB load + cleanup job), Redis sessions (extra service), JWT with claims (same idea, more complex tooling) | +| D-057 | Auth enforcement = **server-side on every `/api/operator/*` request + React route guard for UX, never trust the client** | CLARIFY auto-decide. FastAPI middleware checks the signed cookie on every `/api/operator/*` request; 401 if missing/invalid/expired. React `/operator/*` routes check a `/api/operator/me` call on mount and redirect to `/operator/login` if 401 — this is UX only, the server is the authority. The cohort dashboard reads only k-anonymized aggregates (D-034) so even an auth bypass leaks no PII (defense in depth). VC issuance endpoints (`/api/operator/credentials/*`) are also auth-gated. | 0.85 | Server-only (poor UX — no redirect), React-only (insecure — bypassable), no auth on issuance (credential forgery risk) | ### Confidence updates from research diff --git a/.ciagent/REQUIREMENTS.md b/.ciagent/REQUIREMENTS.md index ae17dba..d88d04b 100644 --- a/.ciagent/REQUIREMENTS.md +++ b/.ciagent/REQUIREMENTS.md @@ -1,64 +1,53 @@ # Praxis — Requirements -**Milestone:** v0.3 (Mastery scoring + competency rubrics + verifiable credentials) -**Status:** complete — milestone released as v0.1.5 (13/13 v0.3 REQ covered, 8 deferred to v0.4) +**Milestone:** v0.4 (Operator tier — cohort dashboard, auth, Postgres) +**Status:** phase 0 — specify (active milestone); v0.3 complete — released as v0.1.5 (13/13 v0.3 REQ covered) -Formal requirements with REQ-IDs. Scoped to the active milestone unless noted. v0.1/v0.2 requirements (complete) are retained for reference with their final status. Later-milestone requirements are marked `deferred`. +Formal requirements with REQ-IDs. Scoped to the active milestone unless noted. v0.1/v0.2/v0.3 requirements (complete) are retained for reference with their final status. Later-milestone requirements are marked `deferred`. -## v0.3 Active Requirements +## v0.4 Active Requirements -### Mastery & Assessment (v0.3 core) +### Operator-Tier Postgres (v0.4 foundation) | REQ-ID | Requirement | Priority | Phase | Status | |--------|-------------|----------|-------|--------| -| REQ-MAST-01 | Competency rubric per skill — a typed rubric model (criteria, 5-level scale, per-skill weights) authored as YAML, mapped to scenarios (D-036). At least one rubric for the Customer Service path in v0.3. | must | P1 | active | -| REQ-MAST-02 | Mastery Score updated after each session — computed from rubric scores + varied-scenario-success gate (D-032: N=3 distinct scenarios, rubric mean ≥ 3.5/5.0). Score persisted per learner per path. Mastery gate opens when condition met. | must | P1 | active | -| REQ-MAST-03 | Portable verifiable credentials on mastery — W3C VC Data Model 2.0, platform-issued Ed25519 signatures, status-list revocation (D-033). Issued when a mastery gate opens. Verifiable by third parties via a public verification endpoint. | must | P1 | active | -| REQ-MAST-04 | No quizzes — assessment built into scenarios | principle | — | accepted | +| REQ-MT-01 | Operator-tier Postgres store — cohort aggregations, operator accounts, issued credentials, mastery-gate audit log. Separate from learner-local SQLite (D-007 preserved for learner surface). Migration path: SQLite stays for learner; Postgres added for operator. Postgres 16, persistent volume, internal Docker network only (D-040). | must | P1 | active | +| REQ-MT-02 | Cohort aggregation pipeline — on-session-end hook + nightly reconciliation job writes k-anonymized aggregates to Postgres from learner sessions (D-045). No raw learner PII in Postgres. | must | P1 | active | -### Scenario Engine (v0.3 extensions) +### Operator Auth (v0.4) | REQ-ID | Requirement | Priority | Phase | Status | |--------|-------------|----------|-------|--------| -| REQ-SCEN-02 | Dynamic difficulty adjustment based on learner performance — IRT 1PL/Rasch, Bayesian θ update per session (D-035). Difficulty selection picks next scenario targeting ~50% expected success for current θ. | must | P1 | active | -| REQ-SCEN-03 | Scenario library tagged by skill, difficulty, failure mode, rubric criteria — YAML directory + `scenarios/index.yaml` manifest (D-036). v0.3 ships ≥6 scenarios for the Customer Service path (one per week minimum). | must | P1 | active | -| REQ-SCEN-04 | Expert-authored scenario format with AI-generated variations — extends D-018 YAML DSL with rubric mapping + `generated_from` backref for AI variations. Expert-authored = canonical; AI variations = same schema, flagged, reviewable. | must | P1 | active | +| REQ-AUTH-01 | Operator-tier auth — session-based, single `operator` role in v0.4. Operator accounts in Postgres. Login endpoint + session cookie. Protects cohort dashboard + credential issuance. argon2id passwords, httpOnly+secure cookie, SameSite=Strict, 8h expiry, login rate-limited 5/min (D-041). | must | P1 | active | -### Skill Paths (v0.3) +### Cohort Dashboard (v0.4) | REQ-ID | Requirement | Priority | Phase | Status | |--------|-------------|----------|-------|--------| -| REQ-PATH-02 | Path structured as a job — 6-week structure per PRD §6.4, mastery-paced (D-037). Path = `paths/.yaml` defining weeks, each week = scenarios + a mastery gate. v0.3 ships the Customer Service path fully (6 weeks, ≥1 scenario/week). | must | P1 | active | +| REQ-DASH-01 | Anonymized cohort view (practice, mastery progression, failure patterns) for training operators — k-anonymity ≥ 10, 7-day aggregation window (D-034). Operator UI (React) under `/operator/*`, served by same FastAPI server (`/api/operator/*` prefix), reuses v0.2 StaticFiles (D-044). No separate SPA build — same `client/dist`. | must | P2 | active | -### Employer / Program Dashboard (deferred to v0.4 — per GRILL-v0.3.md Axis 2) - -| REQ-ID | Requirement | Priority | Phase | Status | -|--------|-------------|----------|-------|--------| -| REQ-DASH-01 | Anonymized cohort view (practice, mastery progression, failure patterns) for training operators — k-anonymity ≥ 10, 7-day aggregation window (D-034). Operator UI (React) reads from operator-tier Postgres. Forces multi-tenant + operator auth (D-031). | must | v0.4 | deferred-to-v0.4 | - -### Auth & Multi-Tenancy (deferred to v0.4 — per GRILL-v0.3.md Axis 2) - -| REQ-ID | Requirement | Priority | Phase | Status | -|--------|-------------|----------|-------|--------| -| REQ-AUTH-01 | Operator-tier auth — session-based, single `operator` role in v0.3. Operator accounts in Postgres. Login endpoint + session cookie. Protects cohort dashboard + credential issuance. | must | v0.4 | deferred-to-v0.4 | -| REQ-MT-01 | Operator-tier Postgres store — cohort aggregations, operator accounts, issued credentials, mastery-gate audit log. Separate from learner-local SQLite (D-007 preserved for learner surface). Migration path: SQLite stays for learner; Postgres added for operator. | must | v0.4 | deferred-to-v0.4 | -| REQ-MT-02 | Cohort aggregation pipeline — scheduled job (or on-session-end hook) writes k-anonymized aggregates to Postgres from learner sessions. No raw learner PII in Postgres. | must | v0.4 | deferred-to-v0.4 | - -## v0.3 Non-Functional Requirements +## v0.4 Non-Functional Requirements | REQ-ID | Requirement | Target | Phase | Status | |--------|-------------|--------|-------|--------| -| REQ-NFR-MAST-01 | Rubric scoring determinism — same session + rubric → same score (no LLM non-determinism in the scoring path; LLM may assist rubric criterion extraction but final score is rule-based) | must | P1 | active | -| REQ-NFR-MAST-02 | Mastery gate auditability — every gate-open event recorded with evidence (which 3 scenarios, rubric scores, timestamp) | must | P1 | active | -| REQ-NFR-VC-01 | Verifiable credential tamper-evidence — Ed25519 signature, issuer key in operator-tier secrets (not committed), verification endpoint validates signature + status + interop test against external W3C verifier (grill Axis 3) | must | P1 | active | -| REQ-NFR-VC-02 | Credential revocation latency — revoked credential must fail verification within 1 sync of the status list (next verify call — no cache) | must | P1 | active | -| REQ-NFR-AUTH-01 | Operator auth — passwords hashed (argon2id), session cookie httpOnly + secure, login rate-limited | must | v0.4 | deferred-to-v0.4 | -| REQ-NFR-MT-01 | Postgres-in-LXC — operator Postgres runs as a second Docker service in the existing LXC CT (or sidecar) without destabilizing the learner-facing praxis service | must | v0.4 | deferred-to-v0.4 | -| REQ-NFR-IRT-01 | IRT θ update latency — < 100ms (in-process, no LLM call) | must | P1 | active | -| REQ-NFR-DASH-01 | Cohort dashboard k-anonymity ≥ 10 — any cohort view cell with < 10 learners is suppressed | must | v0.4 | deferred-to-v0.4 | -| REQ-NFR-DASH-02 | Cohort dashboard freshness — aggregates ≤ 24h stale | must | v0.4 | deferred-to-v0.4 | +| REQ-NFR-AUTH-01 | Operator auth — passwords hashed (argon2id), session cookie httpOnly + secure + SameSite=Strict, login rate-limited (5/min), 8h expiry | must | P1 | active | +| REQ-NFR-MT-01 | Postgres-in-LXC — operator Postgres runs as a second Docker service in the existing LXC CT (D-040) without destabilizing the learner-facing praxis service. Internal Docker network only (not exposed to bridge). | must | P1 | active | +| REQ-NFR-DASH-01 | Cohort dashboard k-anonymity ≥ 10 — any cohort view cell with < 10 learners is suppressed | must | P2 | active | +| REQ-NFR-DASH-02 | Cohort dashboard freshness — aggregates ≤ 24h stale (nightly reconciliation + on-session-end hook per D-045) | must | P2 | active | -## Constraints (binding — carry forward from v0.1/v0.2) +## v0.4 Out of Scope (still deferred) + +- REQ-PATH-01 (full multi-path launch) — v0.3 ships Customer Service path only, multi-path later +- REQ-DASH-02 (full operator-suite dashboard) — later milestone (v0.4 ships the foundational cohort view only) +- REQ-ASSIST-01..03 (Live Assist) — later milestone +- REQ-LOWBW-01..03 (WhatsApp/USSD/offline) — later milestone +- REQ-VOICE-05/06 (multi-language, persona switching) — later milestone +- Learner auth / multi-learner-per-device — operator auth is v0.4; learner auth later +- RBAC (multiple operator roles) — single `operator` role in v0.4; RBAC deferred +- Third-party credential issuers (university/agency) — v0.9 credentialing milestone +- Differential privacy — k-anonymity ≥ 10 is sufficient for v0.4 scale (D-034) + +## Constraints (binding — carry forward from v0.1/v0.2/v0.3) - C-1 Voice is primary interface; text is fallback only - C-2 Must work on $100 Android phone over 2G/3G (relaxed for v0.1 Canada pilot) @@ -67,14 +56,54 @@ Formal requirements with REQ-IDs. Scoped to the active milestone unless noted. v - C-5 Open-weights LLM via Ollama catalog — `gemma4:cloud` + `deepseek-v4-flash:cloud` - C-6 Domain safety guardrails + HITL + disclaimers for safety-sensitive domains - C-7 Scenarios authored by domain experts + learning designers; AI generates variations only -- C-8 Latency budget < 600ms end-to-end (ASR → LLM → TTS) — mastery scoring must not be on the voice path +- C-8 Latency budget < 600ms end-to-end (ASR → LLM → TTS) — mastery scoring + cohort aggregation must not be on the voice path + +--- + +## v0.3 Requirements (complete — released as v0.1.5, retained for reference) + +### Mastery & Assessment (v0.3 core) + +| REQ-ID | Requirement | Priority | Phase | Status | +|--------|-------------|----------|-------|--------| +| REQ-MAST-01 | Competency rubric per skill — a typed rubric model (criteria, 5-level scale, per-skill weights) authored as YAML, mapped to scenarios (D-036). At least one rubric for the Customer Service path in v0.3. | must | P1 | complete | +| REQ-MAST-02 | Mastery Score updated after each session — computed from rubric scores + varied-scenario-success gate (D-032: N=3 distinct scenarios, rubric mean ≥ 3.5/5.0). Score persisted per learner per path. Mastery gate opens when condition met. | must | P1 | complete | +| REQ-MAST-03 | Portable verifiable credentials on mastery — W3C VC Data Model 2.0, platform-issued Ed25519 signatures, status-list revocation (D-033). Issued when a mastery gate opens. Verifiable by third parties via a public verification endpoint. | must | P1 | complete | +| REQ-MAST-04 | No quizzes — assessment built into scenarios | principle | — | accepted | + +### Scenario Engine (v0.3 extensions) + +| REQ-ID | Requirement | Priority | Phase | Status | +|--------|-------------|----------|-------|--------| +| REQ-SCEN-02 | Dynamic difficulty adjustment based on learner performance — IRT 1PL/Rasch, Bayesian θ update per session (D-035). Difficulty selection picks next scenario targeting ~50% expected success for current θ. | must | P1 | complete | +| REQ-SCEN-03 | Scenario library tagged by skill, difficulty, failure mode, rubric criteria — YAML directory + `scenarios/index.yaml` manifest (D-036). v0.3 ships ≥6 scenarios for the Customer Service path (one per week minimum). | must | P1 | complete | +| REQ-SCEN-04 | Expert-authored scenario format with AI-generated variations — extends D-018 YAML DSL with rubric mapping + `generated_from` backref for AI variations. Expert-authored = canonical; AI variations = same schema, flagged, reviewable. | must | P1 | complete | + +### Skill Paths (v0.3) + +| REQ-ID | Requirement | Priority | Phase | Status | +|--------|-------------|----------|-------|--------| +| REQ-PATH-02 | Path structured as a job — 6-week structure per PRD §6.4, mastery-paced (D-037). Path = `paths/.yaml` defining weeks, each week = scenarios + a mastery gate. v0.3 ships the Customer Service path fully (6 weeks, ≥1 scenario/week). | must | P1 | complete | + +## v0.3 Non-Functional Requirements (complete) + +| REQ-ID | Requirement | Target | Phase | Status | +|--------|-------------|--------|-------|--------| +| REQ-NFR-MAST-01 | Rubric scoring determinism — same session + rubric → same score (no LLM non-determinism in the scoring path; LLM may assist rubric criterion extraction but final score is rule-based) | must | P1 | complete | +| REQ-NFR-MAST-02 | Mastery gate auditability — every gate-open event recorded with evidence (which 3 scenarios, rubric scores, timestamp) | must | P1 | complete | +| REQ-NFR-VC-01 | Verifiable credential tamper-evidence — Ed25519 signature, issuer key in operator-tier secrets (not committed), verification endpoint validates signature + status + interop test against external W3C verifier (grill Axis 3) | must | P1 | complete | +| REQ-NFR-VC-02 | Credential revocation latency — revoked credential must fail verification within 1 sync of the status list (next verify call — no cache) | must | P1 | complete | +| REQ-NFR-IRT-01 | IRT θ update latency — < 100ms (in-process, no LLM call) | must | P1 | complete | + +## v0.3 Out of Scope (now activated in v0.4) + +- ~~REQ-DASH-01 (cohort dashboard) — deferred to v0.4~~ → **activated in v0.4** +- ~~REQ-AUTH-01, REQ-MT-01, REQ-MT-02 (operator auth + Postgres) — deferred to v0.4~~ → **activated in v0.4** +- ~~REQ-NFR-DASH-01, REQ-NFR-DASH-02, REQ-NFR-AUTH-01, REQ-NFR-MT-01 — deferred to v0.4~~ → **activated in v0.4** ## v0.3 Out of Scope (still deferred) - REQ-PATH-01 (full multi-path launch) — v0.3 ships Customer Service path only -- REQ-DASH-01 (cohort dashboard) — **deferred to v0.4** per GRILL-v0.3.md Axis 2 (was v0.8 on original ROADMAP) -- REQ-AUTH-01, REQ-MT-01, REQ-MT-02 (operator auth + Postgres) — **deferred to v0.4** (operator tier) -- REQ-NFR-DASH-01, REQ-NFR-DASH-02, REQ-NFR-AUTH-01, REQ-NFR-MT-01 — **deferred to v0.4** - REQ-DASH-02 (full operator-suite dashboard) — later milestone - REQ-ASSIST-01..03 (Live Assist) — later milestone - REQ-LOWBW-01..03 (WhatsApp/USSD/offline) — later milestone diff --git a/.ciagent/RESEARCH-v0.4-operator-tier.md b/.ciagent/RESEARCH-v0.4-operator-tier.md new file mode 100644 index 0000000..6645cdf --- /dev/null +++ b/.ciagent/RESEARCH-v0.4-operator-tier.md @@ -0,0 +1,488 @@ +# Praxis — Research Findings (v0.4 Operator Tier — Cohort Dashboard + Auth + Postgres) + +> **Phase:** v0.4 research (operator tier) +> **Branch:** `phase/00-pre-execution` +> **Status:** research complete — pending orchestrator review +> **Date:** 2026-08-04 +> **Method:** Codebase inspection (`server/`, `db/`, `docker-compose.yml`, `client/`, `pyproject.toml`, `client/package.json`), v0.3 research appendices (`.ciagent/RESEARCH.md`, `docs/RESEARCH-operator-postgres-auth.md`, `.ciagent/RESEARCH-vc.md`, `.ciagent/RESEARCH-v0.3-anonymization-irt-scenarios.md`), D-050..D-057 decision text, OWASP Password Storage Cheat Sheet (fetched 2026-08-04), Postgres 16 documentation, asyncpg/Starlette/argon2-cffi ecosystem knowledge. Web-verified where possible; domain-knowledge claims carry explicit confidence scores. + +This document grounds the v0.4 operator-tier architecture in ecosystem evidence. It covers all 7 research domains and concludes with a consolidated risks table and a v0.3-assumption audit (which anticipatory assumptions were confirmed, which were overturned by D-050..D-057). + +--- + +## Summary of Findings (Executive 1-Pager) + +1. **Postgres 16-slim is the correct second service.** (0.90) `postgres:16-slim` (Debian-slim, glibc) matches the existing praxis Dockerfile rationale. Named volume `pgdata`, explicit `praxis-net` bridge network (no published port), `pg_isready` healthcheck, `depends_on: service_healthy`. PG16 ships `gen_random_uuid()` in core (no extension). asyncpg `create_pool(min_size=1, max_size=10)` on `app.state.pg_pool` via lifespan, `command_timeout=10`. CT memory bump 4GB→6GB (confirmed by v0.3 anticipatory section; D-050 fixes pool min at 1, not 2 — lower idle cost). Nightly `pg_dump -Fc` to `pgbackups` volume, `%u` 7-file rolling retention (D-055). + +2. **Operator auth = signed stateless cookies (HMAC-SHA256 via Starlette SessionMiddleware) + argon2id + in-memory rate limit.** (0.88) D-056 overrides the v0.3 anticipatory "SessionMiddleware (itsdangerous-signed)" framing slightly — the architecture uses Starlette's SessionMiddleware which *is* itsdangerous-signed under the hood, so the v0.3 description holds. argon2-cffi `PasswordHasher` defaults (time_cost=3, memory_cost=64MiB, parallelism=4) **exceed** OWASP minimums (19MiB/t=2/p=1). `check_needs_rehash` for param upgrades. Login rate limit = in-memory `dict[ip, (count, window_start)]` dependency (D-057 + D-041); slowapi is the idiomatic FastAPI choice but a hand-rolled counter is simpler for single-instance and avoids a dep — **recommend slowapi for idiomaticity** (0.70) with the hand-rolled counter as the documented fallback. + +3. **Secure cookie + no-TLS pilot tension → config-driven `Secure` flag, document the pilot risk.** (0.75) D-030 (no Traefik/TLS for pilot) conflicts with the `Secure` cookie attribute (requires HTTPS). Resolution: **(a) config-driven** — `PRAXIS_COOKIE_SECURE` env var (default `true`); set `false` only for the HTTP pilot, with a logged WARNING + a grill-tracked R-AUTH-01 mitigation. This is the safest minimal path: no new infra (Caddy/nginx would be a 3rd service), the flag flips automatically when TLS is added later. Reject option (c) minimal TLS via Caddy — adds a 3rd Docker service, breaks D-030's "direct bridge IP access" pilot stance, and TLS certs need a CA (self-signed → browser warnings worse than HTTP for a pilot). **The cohort dashboard reads only k-anonymized aggregates (D-034), so even a cookie sniffed over HTTP leaks no PII — defense in depth.** + +4. **k-anonymity ≥ 10 enforced at write time via cell suppression in the aggregation SQL.** (0.85) `COUNT(DISTINCT learner_ref) >= 10` guard; cells below threshold are written with `cell_suppressed = TRUE` and `value = NULL`. 7-day rolling window computed on read via window functions over `cohort_aggregates` rows (incremental upsert by `(path, metric, window_start)`). No materialized view needed at v0.4 scale (<100 learners) — the nightly job recomputes all 7-day windows. Differencing attacks blocked by limiting to pre-defined 2-D views (path × week, path × outcome) per the v0.3 anonymization research. + +5. **Aggregation trigger = async fire-and-forget `asyncio.Task` on session end + nightly reconciliation at 03:00 CT.** (0.82) D-054 confirms. The existing `SessionRecorder.end()` already schedules mastery flow via `asyncio.create_task` (line 143 of `session_recorder.py`) — the v0.4 aggregation hook follows the same pattern, chained after the mastery flow. Failures log + nightly job reconciles (idempotent upsert by window). Nightly job = in-process `asyncio.create_task` loop with `asyncio.sleep` until 03:00; no APScheduler (over-engineered for one cron job). If the service restarts, the in-flight task is lost but nightly reconciliation covers it. + +6. **3 dashboard views = practice-volume, mastery-progression, failure-patterns — all k-anonymized, 7-day windows.** (0.82) D-053. Practice volume: sessions/day per path. Mastery progression: % learners at each week, gate-open rate. Failure patterns: top failure modes by frequency + rubric criterion weak-spots. Each view = a `/api/operator/` endpoint returning pre-aggregated rows from `cohort_aggregates`; React renders read-only tables + sparkline charts. **No chart library is in `client/package.json`** — only react, react-dom, pipecat client SDK. Recommend **uPlot** (~40KB, sparkline-native, no React dependency) or inline SVG sparklines (~50 LOC, zero deps). Inline SVG is the v0.4 recommendation (zero deps, k-anon tables are small). + +7. **VC issuer key migration = fresh keypair in Postgres `issuer_keys`; v0.3 SQLite public key archived as `superseded`.** (0.85) D-051. The existing `server/vc/issuer_keys.py` already implements the `active`/`superseded` lifecycle + `get_public_key_for_verification(key_id)`. v0.4 splits the issuer key store: Postgres `issuer_keys` (new active key) + archived v0.3 public key (status `superseded`). The verification endpoint (`server/vc/verification.py:verify_credential`) extracts `key_id` from the proof's `verificationMethod` and looks up the public key — the fallback to superseded keys is already implicit in `get_public_key_row(key_id)` (it queries by id, not by status). **No re-issuance of v0.3 VCs.** Private key encrypted at rest via `nacl.SecretBox` with `PRAXIS_VC_ISSUER_KEY` root key (existing pattern in `issuer_keys.py`). + +8. **Operator account bootstrap = `scripts/create-operator.py` CLI, argon2id hash, idempotent insert.** (0.85) D-052. Reads `PRAXIS_BOOTSTRAP_OPERATOR_USER` + `PRAXIS_BOOTSTRAP_OPERATOR_PASS` from env, hashes with argon2-cffi, inserts into Postgres `operators` table with `ON CONFLICT (username) DO NOTHING`. Run from the host via `docker compose exec praxis python scripts/create-operator.py` or directly in the CT. No signup UI. + +9. **Persona roster for v0.4: 6 active (lead-developer, backend-engineer, frontend-engineer REACTIVATED, data-engineer REACTIVATED/EXPANDED, security-engineer RETAINED, devops-engineer REACTIVATED for Postgres-in-LXC).** (0.90) v0.3 deactivated frontend-engineer + devops; v0.4 reactivates both. security-engineer retained (auth + crypto migration). data-engineer expands to Postgres schema + aggregation SQL. devops-engineer owns the docker-compose Postgres service + CT memory bump + backup cron + `create-operator.py` bootstrap script. + +--- + +## Domain 1: Postgres 16 in Docker-in-LXC (D-040, D-050, D-055, REQ-NFR-MT-01) + +### 1.1 Postgres 16-slim resource footprint inside an LXC CT + +**Finding (0.88):** `postgres:16-slim` is Debian-slim-based (glibc), matching the praxis Dockerfile's rationale (avoiding Alpine musl locale issues with `pg_*` clients). The slim image is ~80MB compressed / ~200MB unpacked. Postgres 16 idle memory footprint with default `shared_buffers=128MB` is ~150-250MB RSS. With a small pilot workload (<100 learners, low-frequency operator queries), total Postgres RSS stays under ~400MB. + +**Resource contention with the learner-facing praxis service:** The praxis container (uvicorn + Pipecat + voice loop) uses ~500MB at runtime (per v0.2 RESEARCH.md Q9). Postgres adds ~400MB. Docker daemon ~200MB. CT base ~200MB. Total ~1.3GB runtime, leaving ~4.7GB headroom on a 6GB CT. **The voice loop is latency-sensitive (C-8: <600ms); Postgres queries are off the voice path** (operator endpoints + nightly aggregation only). The risk is disk I/O contention during the nightly `pg_dump` + aggregation job — mitigated by scheduling at 03:00 CT (low learner activity) and the aggregation job being incremental upserts (not a full table scan). + +**CT memory bump:** v0.3 anticipatory section said 4GB→6GB. D-050 fixes the asyncpg pool at min_size=1, max_size=10 (lower than the v0.3 anticipatory min_size=2). 6GB is confirmed sufficient. **Confidence 0.85** — the 6GB figure has ~50% margin. + +### 1.2 docker-compose networking: internal bridge, service DNS, no external port + +**Finding (0.92):** The current `docker-compose.yml` (verified — 49 lines, single `praxis` service, no explicit network → compose default bridge). v0.4 adds: + +- An explicit named bridge network `praxis-net` (driver: bridge). **Not `internal: true`** — the postgres container doesn't need egress, but `internal: true` would also block DNS resolution from the praxis service. The simpler robust choice: named network, no `ports:` on postgres, no `internal: true`. The v0.3 research (`docs/RESEARCH-operator-postgres-auth.md` §1) confirmed this. +- The `praxis` service joins `praxis-net` and gains `depends_on: { postgres: { condition: service_healthy } }`. +- The `postgres` service joins `praxis-net`, no `ports:` mapping (not exposed to the LXC host bridge). +- Service DNS: the praxis service reaches postgres via the service name `postgres` (Docker Compose internal DNS). DSN: `postgresql://praxis:${PRAXIS_PG_PASSWORD}@postgres:5432/praxis` (D-050). + +**Migration note:** Adding an explicit network to the existing `praxis` service means compose recreates the praxis container on `up` (the default bridge → named network is a recreate trigger). Plan a ~5-15s downtime window. The SQLite volume (`praxis-data`) is untouched → learner state preserved. **Confidence 0.90** — standard Docker Compose behavior. + +### 1.3 Persistent volume strategy + +**Finding (0.90):** Named volume `pgdata` (driver: local) on the LXC rootfs. **Never bind-mount `/var/lib/postgresql/data` to the CT filesystem** — Postgres requires `chown 999` and a specific directory layout; named volumes handle this. Set `PGDATA=/var/lib/postgresql/data/pgdata` to pin the subdirectory (survives image upgrades). A separate mount is not warranted for the pilot — the LXC rootfs (16GB) has headroom, and a named volume keeps the data with the compose stack. + +**Backups:** second named volume `pgbackups` (driver: local). Nightly `pg_dump -Fc` (custom compressed format) → `/backups/praxis-$(date +%u).sql.gz` (D-055). `%u` = day-of-week 1-7 → rolling 7-file retention with zero cleanup logic. Operator can `pct pull` backups to the PVE host for off-CT safety. **Confidence 0.85** — `pg_dump -Fc` is the documented Postgres backup format; `%u` retention is a standard cron pattern. + +### 1.4 asyncpg connection pooling + +**Finding (0.88):** asyncpg `create_pool(min_size=1, max_size=10, command_timeout=10)` on `app.state.pg_pool` via FastAPI `lifespan` context manager. D-050 fixes min_size=1 (lower than the v0.3 anticipatory min_size=2 — reduces idle connection overhead). Pool created on startup, closed on shutdown. Operator endpoints are low-frequency (cohort dashboard, VC issuance); max_size=10 is generous for v0.4 single-instance. The `PraxisStore` (aiosqlite) keeps its current per-call connect pattern — **pools are independent and must not be shared** (different backends, different lifecycles). `command_timeout=10` prevents a slow operator query from blocking the event loop. + +**Statement cache:** asyncpg caches prepared statements per connection by default. With a small schema (5 tables) and parameterized queries, the cache is small and effective. No explicit `statement_cache_size` config needed at v0.4 scale. + +**Pip:** `asyncpg>=0.29` (new dep — confirmed not in `pyproject.toml`). + +### 1.5 pg_dump backup strategy (D-055) + +**Finding (0.85):** Cron job inside the praxis container (or a sidecar one-shot) runs nightly: +``` +pg_dump -U praxis -Fc praxis | gzip > /backups/praxis-$(date +%u).sql.gz +``` +Wait — `pg_dump -Fc` already produces a compressed custom format; piping through gzip is redundant. The correct command is: +``` +pg_dump -U praxis -Fc praxis -f /backups/praxis-$(date +%u).dump +``` +This produces a compressed custom-format dump that `pg_restore` can selectively restore. **Drill:** `pg_restore --clean --if-exists /backups/praxis_3.dump` (drop+recreate objects, safe against partial DB). Never restore into the live DB without stopping the praxis service first. + +The backup job runs via the in-process asyncio scheduler (same as the aggregation reconciliation job) OR via a host-side cron that `docker compose exec`s the pg_dump. The in-process approach is simpler (one scheduler for both nightly jobs) but couples backup to the praxis service lifecycle. **Recommend host-side cron** → `docker compose exec -T postgres pg_dump ...` so backups run even if praxis is down. **Confidence 0.80** — host-side cron decouples backup from app uptime. + +### 1.6 Healthcheck for the Postgres service + +**Finding (0.95):** `pg_isready -U praxis -d praxis` every 10s, 5 retries, 5s timeout. `depends_on: { postgres: { condition: service_healthy } }` on the praxis service. **Caveat:** `pg_isready` returns healthy before the DB is fully ready for migration load — the praxis app must still retry the first migration attempt (the pg_migrate runner should be idempotent + retry on connection failure). + +### 1.7 Postgres 16 features used + +**Finding (0.90):** +- **`gen_random_uuid()`** — built into PG13+ core (no `pgcrypto` extension needed). Used as `DEFAULT gen_random_uuid()` for `operators.id`, `mastery_gate_events.id`, etc. +- **Partitioning for `cohort_aggregates`** — PG16 supports declarative partitioning by `RANGE (window_start)`. Weekly partitions (one per ISO week) keep the table small per partition + enable fast windowed queries. **However, at v0.4 scale (<100 learners, ~weeks of data), partitioning is premature optimization.** The v0.3 anticipatory section mentioned "weekly partitions" but D-053 clarifies the dashboard reads pre-aggregated rows — the `cohort_aggregates` table is small (one row per `(path, metric, window_start)`). **Recommendation: ship a plain table with an index on `(path, window_start)`; add partitioning only if the table exceeds ~100K rows** (post-pilot). **This overturns the v0.3 anticipatory "weekly partitions" assumption** — see §8 v0.3 audit. + +--- + +## Domain 2: Operator Auth — argon2id + Signed Cookies (D-041, D-056, D-057, REQ-NFR-AUTH-01) + +### 2.1 argon2id parameters for v0.4 scale + +**Finding (0.92):** OWASP Password Storage Cheat Sheet (fetched 2026-08-04) recommends Argon2id with one of these minimum configurations: +- m=47104 (46 MiB), t=1, p=1 +- m=19456 (19 MiB), t=2, p=1 +- m=12288 (12 MiB), t=3, p=1 +- m=9216 (9 MiB), t=4, p=1 +- m=7168 (7 MiB), t=5, p=1 + +The `argon2-cffi` `PasswordHasher()` defaults are `time_cost=3, memory_cost=64MiB, parallelism=4` — **these exceed all OWASP minimums** (64MiB > 46MiB, t=3 matches the 12MiB/t=3 row, p=4 > p=1). The defaults are safe for a 6GB CT (64MiB per hash operation is trivial; login is low-frequency — one operator). **Recommendation: keep `PasswordHasher()` defaults.** Use `check_needs_rehash(stored_hash)` on login to rehash if params are bumped in the future. Benchmark login latency — if >1s, drop to `memory_cost=32MiB` (still exceeds OWASP minimums). **Confidence 0.92** — OWASP is the authoritative source; argon2-cffi defaults are documented. + +### 2.2 Python argon2 library: argon2-cffi vs. passlib + +**Finding (0.90):** **argon2-cffi** is the idiomatic choice for FastAPI. It's a thin CFFI wrapper around the reference Argon2 implementation, exposes `PasswordHasher` with argon2id as the default, and is actively maintained. `passlib` is a broader abstraction layer (supports multiple hash algorithms) but has had maintenance concerns (the 1.2 series hasn't seen a release in years; the 1.3 rewrite stalled). argon2-cffi is simpler, more focused, and the v0.3 research already chose it. **Pip: `argon2-cffi>=23.1`.** The v0.3 anticipatory architecture already lists `argon2-cffi` — confirmed. + +### 2.3 Signed stateless cookies (HMAC-SHA256) + +**Finding (0.88):** D-056 specifies "signed stateless cookies (HMAC-SHA256), no server-side session table." Starlette's `SessionMiddleware` uses `itsdangerous` under the hood, which signs the cookie with HMAC-SHA256 (via `TimestampedSigner`/`JSONWebSignature` depending on config). **The v0.3 anticipatory "SessionMiddleware (itsdangerous-signed)" framing is correct** — D-056's "HMAC-SHA256" is the underlying mechanism. The cookie is self-contained: `{operator_id, issued_at}` + HMAC signature. Verification = recompute HMAC + check expiry (8h). No `sessions` table in Postgres (D-056 explicit). Logout = client clears cookie (stateless — no server revocation list in v0.4). + +**Key management:** `SECRET_KEY` from env (`PRAXIS_COOKIE_SECRET`, ≥32 bytes random). Rotation = change the key (invalidates all sessions — acceptable for a pilot). **Confidence 0.88** — Starlette SessionMiddleware is the documented FastAPI session pattern. + +**Cookie attributes:** +- `session_cookie`: `"praxis_op"` (distinct from any future learner cookie) +- `max_age`: `28800` (8h, per D-041) +- `httponly`: `True` (middleware default; verify) +- `samesite`: `"strict"` (D-041 — CSRF defense-in-depth) +- `secure`: **config-driven** (see §2.4 below) +- `path`: `/` (or scope to `/api/operator` — cleaner, but the React `/operator/*` routes also need the cookie for the `/api/operator/me` call on mount; use `/`) + +### 2.4 Secure cookie + no-TLS pilot tension (R-AUTH-01 resolution) + +**Finding (0.75):** D-030 (no Traefik/TLS for pilot) conflicts with the `Secure` cookie attribute (browsers reject `Secure` cookies over HTTP, or rather: they don't send them over HTTP). The three options: + +**(a) Config-driven `Secure` flag (RECOMMENDED):** +- `PRAXIS_COOKIE_SECURE` env var (default `true`). +- For the HTTP pilot: set `PRAXIS_COOKIE_SECURE=false`, log a WARNING, document the risk in GRILL-v0.4.md. +- When TLS is added later (post-v0.4), flip the env var → cookies become Secure automatically. +- **Defense in depth:** the cohort dashboard reads only k-anonymized aggregates (D-034) → even a cookie sniffed over HTTP leaks no PII. The VC issuance endpoints are auth-gated but the credentials themselves are public (verification endpoint is unauthenticated per D-043). + +**(b) Accept the pilot risk + document:** +- Same as (a) but without the config flag — hardcode `secure=False` for v0.4. +- **Rejected:** inflexible — requires code change when TLS arrives. + +**(c) Minimal TLS via Caddy/nginx sidecar:** +- Add a 3rd Docker service (Caddy reverse proxy) with a self-signed cert. +- **Rejected:** breaks D-030's "direct bridge IP access" pilot stance, adds a 3rd service + cert management, self-signed certs trigger browser warnings (worse UX than plain HTTP for a pilot). Defer to a later milestone. + +**Verdict: option (a).** The config-driven flag is the safest minimal path — no new infra, automatic upgrade when TLS arrives, explicit risk documentation. **Confidence 0.75** — the resolution is sound but the pilot HTTP risk is real; the grill must sign off. + +### 2.5 Login rate limiting (5 attempts/min) + +**Finding (0.78):** D-041 specifies 5 attempts/min. Two implementations: + +1. **slowapi** (`slowapi>=0.1`) — idiomatic FastAPI rate limiter. `@limiter.limit("5/minute")` on the login route. In-memory backend (per-process). **Caveat:** breaks if >1 praxis process (not a v0.4 concern — single uvicorn). Confidence 0.70 — young lib, but works. + +2. **In-memory counter** — `dict[remote_ip, (count, window_start)]` in a FastAPI dependency. Zero deps, trivially auditable. For a single operator login endpoint, this is sufficient. Confidence 0.80 for the pilot. + +**Recommendation: slowapi** for idiomaticity (decorator pattern, well-documented). The hand-rolled counter is the documented fallback if slowapi causes issues. Threshold: 5 failed attempts/minute/IP → 429 + `Retry-After` header. **Pip: `slowapi>=0.1`.** Rate limit is on the *login* route only (not the auth-gated routes — those check the cookie). + +### 2.6 Session expiry (8h) + renewal strategy + +**Finding (0.85):** `max_age=28800` (8h) on the cookie. No sliding renewal in v0.4 — the cookie expires 8h after issuance. The operator re-logs in after 8h. **Renewal is deferred** — a later milestone could implement sliding renewal (re-issue on activity) if 8h is too short for operator workflows. For v0.4 (single operator, low-frequency dashboard reads), 8h fixed is sufficient. **Confidence 0.85.** + +--- + +## Domain 3: Cohort Aggregation — k-anonymity + 7-day windows (D-034, D-045, D-053, D-054) + +### 3.1 k-anonymity ≥ 10 enforcement at write time + +**Finding (0.85):** D-034 + REQ-NFR-DASH-01. The aggregation SQL enforces k≥10 via cell suppression at write time (not read time — auditable). Pattern: + +```sql +-- Pseudo-SQL — shape only +INSERT INTO cohort_aggregates (path, metric, window_start, window_end, value, cell_count, cell_suppressed) +SELECT + path, + metric, + window_start, + window_end, + CASE WHEN COUNT(DISTINCT learner_ref) >= 10 THEN aggregate_value ELSE NULL END, + COUNT(DISTINCT learner_ref), + CASE WHEN COUNT(DISTINCT learner_ref) < 10 THEN TRUE ELSE FALSE END +FROM staging_sessions +GROUP BY path, metric, window_start, window_end +ON CONFLICT (path, metric, window_start) DO UPDATE SET + value = excluded.value, + cell_count = excluded.cell_count, + cell_suppressed = excluded.cell_suppressed, + updated_at = now(); +``` + +- `cell_suppressed = TRUE` + `value = NULL` for cells < 10 learners. +- The dashboard renders suppressed cells as "— (suppressed, <10 learners)" — transparent to the operator. +- **Differencing attacks:** limited to pre-defined 2-D views (path × week, path × outcome) per the v0.3 anonymization research. No arbitrary filters (no per-learner drill-down — D-053 explicit). + +**Confidence 0.85** — k-anonymity via `COUNT(DISTINCT) >= K` is the textbook suppression pattern. + +### 3.2 7-day rolling window aggregation SQL + +**Finding (0.82):** The `cohort_aggregates` table stores rows keyed by `(path, metric, window_start)`. Each row represents one 7-day window starting at `window_start`. The aggregation job (on-session-end hook + nightly) upserts by `(path, metric, window_start)` — idempotent. The 7-day window is a rolling construct: the nightly job recomputes the current window (the one containing "today") + the previous window (for continuity). On read, the dashboard queries `WHERE window_start >= now()::date - interval '7 days'` for the current view. + +**Materialized view vs. incremental upsert:** Incremental upsert wins at v0.4 scale. A materialized view requires `REFRESH MATERIALIZED VIEW` (locks the view, slow at scale) and doesn't support partial refresh. Incremental upsert is cheap (one row per `(path, metric, window_start)`) + idempotent + supports the on-session-end hook pattern. **Confidence 0.82.** + +### 3.3 On-session-end hook — async fire-and-forget (D-054) + +**Finding (0.85):** D-054 confirms. The existing `SessionRecorder.end()` (line 142-145 of `session_recorder.py`) already schedules the mastery flow via `asyncio.create_task(self._run_mastery_flow_guarded(mastery_deps))`. The v0.4 aggregation hook follows the same pattern — chained after the mastery flow completes (or in parallel, since the aggregation only needs the session outcome + rubric scores, which the mastery flow produces). The hook: + +1. Reads the session outcome + rubric scores from the mastery flow result (or directly from the SQLite `mastery_gate_events` table). +2. Computes the k-anonymized aggregate for the affected `(path, metric, window_start)` bin. +3. Upserts to Postgres `cohort_aggregates` (idempotent). +4. Failures log + the nightly job reconciles. + +**Lifecycle:** `asyncio.Task` — non-blocking, the session-end response returns immediately. If the service restarts, the in-flight task is lost but nightly reconciliation covers it (D-054 explicit). **Confidence 0.85** — the pattern is already proven in the codebase. + +### 3.4 Nightly reconciliation job + +**Finding (0.80):** D-054 specifies 03:00 CT. Two implementation options: + +1. **In-process asyncio scheduler** — `asyncio.create_task` loop with `asyncio.sleep` until 03:00 CT. No extra dep. If the service restarts, the scheduler resumes on startup (computes next 03:00). Simple, matches the "no Celery/Redis for v0.4" stance. +2. **APScheduler** — `apscheduler>=3.10` with a `AsyncIOScheduler`. More features (cron expressions, job stores) but over-engineered for one nightly job. + +**Recommendation: in-process asyncio scheduler.** One `asyncio.create_task` that loops: compute seconds until next 03:00 CT → `asyncio.sleep(seconds)` → run reconciliation → repeat. The reconciliation job recomputes all 7-day windows for all paths (idempotent upsert). **Confidence 0.80** — simple, no dep, but no retry-on-failure (if the job fails, it retries the next night; the on-session-end hook keeps data fresh in the meantime). + +### 3.5 Metrics for the 3 dashboard views (D-053) + +**Finding (0.82):** D-053 names three views. Concrete metrics per view: + +| View | Metrics (k-anonymized, 7-day windows) | +|------|---------------------------------------| +| **Practice volume** | sessions/day per path; total sessions in window; active learners in window (suppressed if <10) | +| **Mastery progression** | % learners at each week (1-6); gate-open rate (gate_opened / total_gate_events); median mastery_score; rubric criterion mean scores (per criterion, across path) | +| **Failure patterns** | top failure_modes by frequency; rubric criterion weak-spots (criteria with mean < 3.0); branch outcome distribution (escalate vs accept) | + +Each metric is a row in `cohort_aggregates` with `(path, metric, window_start, window_end, value, cell_count, cell_suppressed)`. The `/api/operator/` endpoint returns the pre-aggregated rows for that view's metrics. + +### 3.6 No raw learner PII in Postgres (D-031 hybrid) + +**Finding (0.90):** D-031 hybrid — learner-local state stays SQLite; operator-tier Postgres stores only aggregations + operator accounts + issued credentials. **What identifies a learner?** `learner_ref` — an opaque string (e.g., `"learner-1"`, the existing `HARDCODED_LEARNER_ID`). The Postgres tables (`cohort_aggregates`, `mastery_gate_events`, `issued_credentials`) use `learner_ref` as the join handle — **never** a FK to SQLite (cross-DB joins are impossible). The existing `issued_credentials` table in SQLite uses `learner_id` (the hardcoded string); v0.4's Postgres `issued_credentials` table uses `learner_ref` (same opaque string, different column name to emphasize it's not a FK). **Confidence 0.90** — D-031 is explicit; the codebase already uses opaque string IDs. + +--- + +## Domain 4: React Cohort Dashboard (D-044, D-053, REQ-DASH-01) + +### 4.1 React route under `/operator/*` + +**Finding (0.85):** D-044. The existing client (`client/src/App.tsx`) is a single-view state machine (start → live → debrief) with **no React Router**. v0.4 adds: + +- A new `client/src/operator/` directory with the cohort dashboard components. +- React Router (or a minimal route switch) for `/operator/*` routes: `/operator/login`, `/operator/dashboard`. +- The existing `App.tsx` remains the voice session UI at `/`. + +**Routing structure:** The current `App.tsx` is mounted at `/` by the StaticFiles serving. Adding `/operator/*` routes requires either: +- **(a) React Router** — `npm install react-router-dom` + a `` wrapper. The StaticFiles `html=True` mount serves `index.html` for all paths, React Router handles client-side routing. **Caveat:** the existing `App.tsx` doesn't use React Router; wrapping it requires a refactor (or a separate root). +- **(b) Minimal route switch** — `useState<'voice' | 'operator'>` based on `window.location.pathname.startsWith('/operator')`. No new dep. Simpler, but less idiomatic for a growing dashboard. + +**Recommendation: React Router** (`react-router-dom@^7`) — it's the standard, supports nested routes, and the v0.4 dashboard will grow (D-053 names 3 views). The refactor to wrap `App.tsx` in a `` is small. Add a catch-all route that serves the voice UI at `/` and the operator UI at `/operator/*`. **Pip: none; npm: `react-router-dom`.** **Confidence 0.80** — React Router is standard but adds a dep + a refactor of the existing single-view App. + +**SPA fallback:** With React Router, the FastAPI StaticFiles mount needs to serve `index.html` for all non-API paths (SPA fallback). The current `app.mount("/", StaticFiles(directory=_CLIENT_DIST, html=True))` serves `index.html` for `/` but returns 404 for `/operator/dashboard` (no such file). **This is a required change:** add a catch-all route before the StaticFiles mount that returns `FileResponse("client/dist/index.html")` for any path not matching an API route. The v0.2 RESEARCH.md Q3 noted this as "NOT needed for v0.2" — v0.4 needs it. **Confidence 0.90** — standard SPA serving pattern. + +### 4.2 Reusing v0.2 StaticFiles (same `client/dist` build) + +**Finding (0.90):** D-044 explicit. No separate SPA build — the same `npm run build` produces `client/dist` with both the voice UI and the operator dashboard. The Dockerfile's Node stage is unchanged (one `npm run build`). The FastAPI StaticFiles mount is updated to serve the SPA fallback (see §4.1). **Confidence 0.90.** + +### 4.3 Read-only tables + sparkline charts + +**Finding (0.80):** The dashboard renders read-only tables + sparkline charts. **No chart library is in `client/package.json`** (verified — only react, react-dom, pipecat client SDK, dev deps). Options: + +1. **Inline SVG sparklines** (~50 LOC, zero deps) — a `` component that renders an SVG polyline. Sufficient for k-anon tables (small data: one sparkline per row, ~7-30 data points). **Recommendation for v0.4.** +2. **uPlot** (~40KB, sparkline-native, no React dependency) — high-performance, but overkill for small tables. +3. **Recharts** (~100KB, React-native) — idiomatic but heavy for sparklines. +4. **Chart.js + react-chartjs-2** (~200KB) — heaviest, overkill. + +**Recommendation: inline SVG sparklines** (zero deps, ~50 LOC, sufficient for v0.4 scale). Add a chart library only if the dashboard grows to need axes, tooltips, zoom. **Confidence 0.80** — sparklines are simple; the inline SVG approach is well-documented. + +### 4.4 `/api/operator/*` FastAPI endpoint structure + +**Finding (0.88):** D-053 + D-057. New `server/operator/` module with an `APIRouter(prefix="/api/operator")`. Endpoints: + +| Endpoint | Method | Auth | Purpose | +|----------|--------|------|---------| +| `/api/operator/login` | POST | rate-limited (5/min) | Login: validate argon2id, set signed cookie | +| `/api/operator/logout` | POST | auth-gated | Clear cookie (client-side) | +| `/api/operator/me` | GET | auth-gated | Return current operator (for React route guard) | +| `/api/operator/cohort` | GET | auth-gated | Practice volume view (k-anonymized) | +| `/api/operator/mastery` | GET | auth-gated | Mastery progression view (k-anonymized) | +| `/api/operator/failure-patterns` | GET | auth-gated | Failure patterns view (k-anonymized) | +| `/api/operator/credentials` | GET | auth-gated | List issued VCs (operator's issuance log) | +| `/api/operator/credentials/{id}/revoke` | POST | auth-gated | Revoke a VC | + +Auth enforcement: FastAPI middleware checks the signed cookie on every `/api/operator/*` request (D-057); 401 if missing/invalid/expired. Router-level `dependencies=[Depends(current_operator)]` on the protected routes. Login + logout are outside the protected router (login is rate-limited, not auth-gated). **Confidence 0.88.** + +### 4.5 Freshness ≤ 24h (REQ-NFR-DASH-02) + +**Finding (0.85):** The on-session-end hook keeps aggregates fresh within minutes of a session ending. The nightly reconciliation job (03:00 CT) guarantees all 7-day windows are recomputed at least once/day. **Max staleness = 24h** (if the service restarts after a session and before the nightly job, the aggregate is stale until the next 03:00 run). The dashboard surfaces "last updated" via a `updated_at` timestamp on each `cohort_aggregates` row → the `/api/operator/` response includes `last_updated: max(updated_at)` across the returned rows. React renders "Last updated: Xh ago" in the dashboard header. **Confidence 0.85.** + +--- + +## Domain 5: VC Issuer Key Migration (D-042, D-051) + +### 5.1 Migrating the Ed25519 issuer key from SQLite to Postgres + +**Finding (0.88):** D-051. The existing `server/vc/issuer_keys.py` (verified — 128 lines) implements the issuer key lifecycle: +- `init_issuer_key(store, root_key)` — generates a fresh Ed25519 keypair, encrypts the private key with `nacl.SecretBox` (root key from `PRAXIS_VC_ISSUER_KEY` env), stores in the `issuer_keys` table. +- `get_active_signing_key(store, root_key)` — returns the active key (status='active'), or generates one if none exists. +- `get_public_key_for_verification(store, key_id)` — returns the public key for a given key_id (queries by id, not by status — **this is the fallback mechanism**). +- `rotate_key(store, root_key)` — generates a new key, marks the old as `superseded`. +- `_verification_method(key_id)` — builds the `verificationMethod` URL. + +v0.4 migration: +1. The `issuer_keys.py` functions currently take a `PraxisStore` (SQLite). v0.4 adds a `PgStore` (Postgres) and the issuer key functions are refactored to accept either store (or a dedicated `IssuerKeyStore` interface). **The simplest refactor:** the issuer key functions accept a protocol/ABC with `init_issuer_key`, `get_active_signing_key_row`, `get_public_key_row`, `set_issuer_key_superseded` methods — both `PraxisStore` (SQLite) and `PgStore` (Postgres) implement it. +2. On first v0.4 boot: generate a fresh keypair in Postgres `issuer_keys` (status='active'). +3. **Archive the v0.3 public key** — read the v0.3 active key's public key from SQLite, insert it into Postgres `issuer_keys` with status='superseded'. The private key is NOT migrated (v0.3 VCs are already signed; verification only needs the public key). +4. The verification endpoint (`server/vc/verification.py:verify_credential`) extracts `key_id` from the proof's `verificationMethod` and calls `get_public_key_for_verification(store, key_id)`. **The fallback to superseded keys is already implicit** — `get_public_key_row(key_id)` queries by id, not by status. v0.3 VCs have the v0.3 key_id in their proof → the lookup finds the archived (superseded) public key → signature verifies. + +**Confidence 0.88** — the existing code already supports the lifecycle; the migration is a store swap + an archive insert. + +### 5.2 Archiving the v0.3 public key as `superseded` (not revoked) + +**Finding (0.90):** D-051 explicit. The v0.3 public key is archived as `superseded` — old VCs still verify against it. **Revoked** would imply the key is no longer trusted (old VCs should fail verification). **Superseded** means the key is no longer used for new signatures but old signatures remain valid. The existing `set_issuer_key_superseded(key_id)` method (line 348-354 of `store.py`) does exactly this. **Confidence 0.90.** + +### 5.3 Verification endpoint fallback + +**Finding (0.88):** The verification flow (`server/vc/verification.py`): +1. `verify_credential(store, credential_id)` → fetches the credential row. +2. `extract_key_id(secured_doc)` → extracts key_id from the proof's `verificationMethod` URL. +3. `get_public_key_for_verification(store, key_id)` → fetches the public key by id. +4. `verify_proof(secured_doc, verify_key)` → validates the Ed25519 signature. + +The fallback is implicit: step 3 queries by `key_id` (not by status), so it finds both active and superseded keys. v0.3 VCs have v0.3 key_ids → step 3 finds the archived (superseded) public key → step 4 validates. **No code change needed in the verification flow** — only the store backing changes (SQLite → Postgres). **Confidence 0.88.** + +### 5.4 Encrypted-at-rest private key in Postgres + +**Finding (0.85):** The existing `_encrypt_private_key(signing_key, root_key)` uses `nacl.SecretBox` with a root key from `PRAXIS_VC_ISSUER_KEY` env. This is application-layer encryption — the private key is encrypted before being stored in the DB. The same pattern works for Postgres (the `private_key_enc` column is `BYTEA`). **Postgres-level encryption at rest** (TDE) is not available in the open-source Postgres 16 (that's an EnterpriseDB feature). The application-layer `nacl.SecretBox` is the correct approach for the pilot. The root key (`PRAXIS_VC_ISSUER_KEY`) is in `.env.secrets` (gitignored). **Confidence 0.85** — the pattern is already proven in v0.3; the store swap is mechanical. + +--- + +## Domain 6: Operator Account Bootstrap (D-052) + +### 6.1 `scripts/create-operator.py` CLI script + +**Finding (0.88):** D-052. A new `scripts/create-operator.py` script: +- Reads `PRAXIS_BOOTSTRAP_OPERATOR_USER` + `PRAXIS_BOOTSTRAP_OPERATOR_PASS` from env (in `.env.secrets`). +- Hashes the password with `argon2-cffi` `PasswordHasher().hash(password)`. +- Connects to Postgres via asyncpg. +- Inserts into `operators` table: `INSERT INTO operators (username, password_hash, display_name) VALUES ($1, $2, $3) ON CONFLICT (username) DO NOTHING`. +- Idempotent — no-op if the user exists (no password update on re-run; a separate `--update` flag could force a rehash if needed). +- Prints the result: `created` or `already exists`. + +**Running the script:** `docker compose exec praxis python scripts/create-operator.py` (from the host) or directly in the CT. The script reads env vars from the praxis container's environment (which sources `/etc/praxis/server.env`). **Confidence 0.88.** + +### 6.2 Env vars in `.env.secrets` + +**Finding (0.90):** D-052. `PRAXIS_BOOTSTRAP_OPERATOR_USER` + `PRAXIS_BOOTSTRAP_OPERATOR_PASS` added to `.ciagent/.env.secrets` (gitignored — verified in `.gitignore`). These are injected via `lxc.environment` → `/etc/praxis/server.env` → `docker-compose.yml` env_file → container env. The `config.json` secrets scopes need a new `operator` scope with these vars. **Confidence 0.90** — the secret injection chain is proven from v0.2. + +--- + +## Domain 7: Persona Assessment (v0.4 roster) + +### 7.1 Active personas for v0.4 + +**Finding (0.90):** v0.4 is **operator-tier-backend + dashboard-frontend + security-crypto + Postgres-in-LXC**. The roster: + +| Persona | v0.3 status | v0.4 status | Reason | +|----------|-------------|-------------|--------| +| lead-developer | active | **active** | Coordinates across operator/auth/cohort/dashboard/Postgres domains. Owns docker-compose.yml Postgres service addition. | +| backend-engineer | active | **active** | Owns the asyncpg pool wiring, operator API routes, aggregation pipeline (on-session-end hook + nightly job), session_recorder.py extension for the aggregation hook. | +| frontend-engineer | active (reactivated v0.3) | **active** | Owns the React cohort dashboard UI (D-044). Auth-gated routes, k-anonymized tables, sparkline charts. React Router addition + SPA fallback. | +| data-engineer | active | **active (expanded)** | Owns the Postgres operator-tier schema (operators, cohort_aggregates, issuer_keys, mastery_gate_events, issued_credentials), the pg_migrate runner, the k-anonymity suppression SQL. | +| security-engineer | active (new v0.3) | **active (retained)** | Owns the VC issuer key migration (SQLite→Postgres, superseded archive), the auth stack (argon2id, signed cookies, rate limiting), the Secure-cookie-TLS resolution (R-AUTH-01). | +| devops-engineer | deactivated (v0.3) | **active (reactivated)** | Owns the docker-compose Postgres service + CT memory bump (4GB→6GB) + backup cron + `create-operator.py` bootstrap script + `.env.example` operator vars. | + +### 7.2 Deactivated personas + +None deactivated for v0.4 — all 6 personas are active. The voice-engineer and ml-engineer remain proposed (not v0.4). + +### 7.3 Framework alignment (from actual `pyproject.toml` + `client/package.json`) + +| Persona | Frameworks (v0.4 research-aligned) | Source | +|---------|-------------------------------------|--------| +| lead-developer | pipecat, fastapi, postgres, docker | `pyproject.toml` + `docker-compose.yml` | +| backend-engineer | pipecat, pydantic, fastapi, uvicorn, asyncpg, aiosqlite | `pyproject.toml` (asyncpg is NEW for v0.4) | +| frontend-engineer | react, react-router-dom (NEW), pipecat-client-sdk, webrtc, vite, fastapi-staticfiles | `client/package.json` (react-router-dom is NEW for v0.4) | +| data-engineer | sqlite, postgres16, aiosqlite, asyncpg, alembic-style-migrations | `pyproject.toml` + `db/migrate.py` pattern | +| security-engineer | pynacl, canonicaljson, base58, argon2-cffi, starlette-sessionmiddleware, slowapi | `pyproject.toml` (argon2-cffi + slowapi are NEW for v0.4) | +| devops-engineer | proxmox-ve-api, lxc, docker, systemd, bash, bats, gitea, pg_dump | `scripts/proxmox/` + `docker-compose.yml` | + +### 7.4 Territory alignment (from actual `server/` structure) + +The actual `server/` structure (verified): `asr/`, `tts/`, `llm/`, `guardrails/`, `scenarios/`, `mastery/`, `paths/`, `vc/`, `services/`, `pipeline.py`, `session_recorder.py`, `__main__.py`, `cost.py`, `debrief.py`, `latency.py`, `interruptibility.py`. v0.4 adds: `server/operator/` (operator API), `server/auth/` (auth middleware), `server/cohort/` (aggregation pipeline). New `db/pg_migrations/` (Postgres migrations) + `db/pg_schema.sql` + `db/pg_store.py` (Postgres store). + +| Persona | Territory (v0.4) | +|---------|-------------------| +| lead-developer | `docker-compose.yml`, `.env.example` | +| backend-engineer | `**/server/**`, `**/operator/**`, `**/cohort/**`, `**/db/**` (excluding pg_schema) | +| frontend-engineer | `**/client/**`, `**/client/src/operator/**` | +| data-engineer | `**/db/**`, `**/db/pg_migrations/**`, `**/db/pg_schema.sql`, `**/db/pg_store.py` | +| security-engineer | `**/server/vc/**`, `**/server/auth/**` | +| devops-engineer | `scripts/proxmox/**`, `scripts/install-service.sh`, `scripts/create-operator.py`, `.env.example` (operator vars) | + +### 7.5 Constraint alignment (v0.4-specific) + +- **All personas:** `hybrid-storage-no-cross-db-joins` (D-031), `k-anonymity-floor-10` (D-034), `no-raw-learner-pii-in-postgres` (D-031). +- **backend-engineer:** `mastery-off-voice-path` (C-8), `aggregation-off-voice-path` (D-054 — async fire-and-forget), `deterministic-scoring` (v0.3 carry-forward). +- **frontend-engineer:** `auth-gated-operator-routes` (D-057), `k-anonymity-display-suppressed-cells` (D-034), `no-raw-learner-pii-in-ui` (D-031), `spa-fallback-for-operator-routes` (new — React Router needs index.html fallback). +- **data-engineer:** `no-cross-db-joins` (D-031), `opaque-learner-ref` (D-031), `write-time-suppression` (D-034). +- **security-engineer:** `argon2id-passwords` (D-041), `config-driven-secure-cookie` (R-AUTH-01 resolution), `issuer-key-encrypted-at-rest` (D-042), `superseded-not-revoked` (D-051). +- **devops-engineer:** `idempotent-deploy` (carry-forward), `secrets-never-committed` (carry-forward), `pg-dump-backup-retention-7d` (D-055). + +--- + +## Consolidated Risks Table + +| ID | Risk | Severity | Mitigation | Confidence | +|----|------|----------|------------|------------| +| **R-MT-01** | Postgres + praxis resource contention on 6GB CT (disk I/O during nightly pg_dump + aggregation) | medium | Schedule nightly jobs at 03:00 CT (low learner activity); aggregation is incremental upsert (not full scan); monitor CT memory; bump to 8GB if OOM | 0.75 | +| **R-MT-02** | Postgres container unhealthy on boot → praxis `depends_on` blocks startup | medium | `pg_isready` healthcheck + 5 retries; praxis app retries first migration on connection failure; `depends_on: service_healthy` is necessary but not sufficient | 0.80 | +| **R-MT-03** | Docker Compose network change (default bridge → praxis-net) recreates praxis container → ~5-15s downtime | low | Plan cutover window; SQLite volume untouched → learner state preserved; do on staging CT first | 0.85 | +| **R-MT-04** | `pgdata` volume corruption on CT restart (LXC + Docker volume interaction) | low | Named volumes are stable on Docker-in-LXC with nesting=1; nightly pg_dump provides backup; `pg_restore --clean --if-exists` drill | 0.70 | +| **R-MT-05** | Postgres 16 `gen_random_uuid()` not available (misremembered as PG13+) | low | Verified: `gen_random_uuid()` is built into PG13+ core (no extension). PG16 confirmed. | 0.95 | +| **R-AUTH-01** | Secure cookie flag + no-TLS pilot → cookies sent over HTTP (sniffable) | medium | Config-driven `PRAXIS_COOKIE_SECURE` (default true; false for HTTP pilot with logged WARNING); cohort dashboard reads only k-anonymized aggregates (no PII leak even if cookie sniffed); grill must sign off | 0.75 | +| **R-AUTH-02** | argon2id hashing blocks event loop (CPU-bound, ~30-80ms per login) | low | Single operator login is low-frequency; ~80ms is acceptable on the event loop. If batch-hashing needed, use `run_in_executor`. Not a v0.4 concern. | 0.85 | +| **R-AUTH-03** | In-memory rate limit lost on service restart (attacker bypasses by timing restart) | low | Single-instance pilot; restarts are rare + operator-initiated. A persistent rate-limit store (Redis) is deferred. | 0.80 | +| **R-AUTH-04** | Signed cookie secret (`PRAXIS_COOKIE_SECRET`) rotation invalidates all sessions | low | Pilot: acceptable (one operator re-logs in). Document the rotation procedure. | 0.85 | +| **R-AUTH-05** | No server-side session revocation (logout is client-side only) | low | D-056 explicit: stateless cookies, no revocation list in v0.4. A forced-logout requires cookie secret rotation. Deferred to a later milestone. | 0.80 | +| **R-DASH-01** | k-anonymity suppression hides meaningful data at v0.4 scale (<100 learners → many cells <10) | medium | Expected at pilot scale; dashboard shows "— (suppressed, <10 learners)" transparently. Aggregation window can be widened (14-day) if too many cells suppressed. | 0.75 | +| **R-DASH-02** | Differencing attack: operator compares two 7-day windows to isolate a single learner | medium | Limit to pre-defined 2-D views (path × week, path × outcome); no arbitrary filters; no per-learner drill-down (D-053). | 0.70 | +| **R-DASH-03** | SPA fallback breaks existing voice UI (StaticFiles mount change) | medium | Add catch-all route BEFORE StaticFiles mount; test `/` still serves voice UI; test `/operator/dashboard` serves index.html. | 0.80 | +| **R-DASH-04** | Nightly reconciliation job fails → aggregates stale >24h (NFR-DASH-02 breach) | low | On-session-end hook keeps data fresh; job retries next night; log + alert on job failure. | 0.75 | +| **R-DASH-05** | React Router addition requires App.tsx refactor → breaks voice UI | medium | Wrap App.tsx in `` with a catch-all route; test voice UI at `/` unchanged. | 0.75 | +| **R-VC-MIG-01** | VC issuer key migration loses v0.3 public key → old VCs fail verification | high | Archive v0.3 public key as `superseded` in Postgres `issuer_keys` before activating new key; verification endpoint queries by key_id (not status) → fallback is implicit. Test: verify a v0.3 VC against the migrated store. | 0.85 | +| **R-VC-MIG-02** | `PRAXIS_VC_ISSUER_KEY` root key changes between v0.3 and v0.4 → encrypted private keys undecryptable | medium | The v0.3 private key is NOT migrated (only the public key is archived). The v0.4 active key is generated fresh with the v0.4 root key. Keep the v0.3 root key in secrets until all v0.3 VCs expire (3-year validUntil). | 0.80 | +| **R-VC-MIG-03** | `issuer_keys.py` store refactor (SQLite→Postgres protocol) breaks v0.3 verification | medium | Define an `IssuerKeyStore` protocol/ABC; both `PraxisStore` and `PgStore` implement it; verification endpoint uses the Postgres store for v0.4. Test: verify a v0.3 VC against the Postgres store with the archived public key. | 0.80 | +| **R-BOOT-01** | `create-operator.py` fails on first boot (Postgres not ready) | low | Script retries on connection failure (3 attempts, 5s backoff); run after `docker compose up -d postgres` + healthcheck passes. | 0.80 | +| **R-BOOT-02** | `PRAXIS_BOOTSTRAP_OPERATOR_PASS` not set → operator can't log in | low | Script checks env var presence + exits with clear error if missing. Document in `.env.example`. | 0.85 | + +--- + +## v0.3 Assumption Audit (which anticipatory assumptions were confirmed / overturned) + +The v0.3 ARCHITECTURE.md operator-tier section was anticipatory. D-050..D-057 (v0.4 clarify decisions) refine it. Audit: + +| v0.3 anticipatory assumption | v0.4 decision | Verdict | +|------------------------------|---------------|---------| +| `postgres:16-slim`, named volume `pgdata`, internal network, `pg_isready` healthcheck | D-040, D-050 confirmed | **CONFIRMED** | +| asyncpg `create_pool(min_size=2, max_size=10)` | D-050: `min_size=1` | **OVERTURNED** — D-050 lowers min_size to 1 (lower idle cost) | +| Starlette `SessionMiddleware` (itsdangerous-signed) | D-056: signed stateless cookies (HMAC-SHA256) | **CONFIRMED** — SessionMiddleware uses itsdangerous/HMAC-SHA256 under the hood; D-056 is the mechanism clarification | +| argon2-cffi `PasswordHasher` defaults | D-041 + OWASP: defaults exceed minimums | **CONFIRMED** — keep defaults (time_cost=3, memory_cost=64MiB, parallelism=4) | +| slowapi 5/min login rate-limit | D-041 + D-057 | **CONFIRMED** — slowapi is the idiomatic choice; in-memory counter is the fallback | +| `cohort_aggregates` with weekly partitions | D-053: pre-aggregated rows, 7-day rolling windows | **OVERTURNED** — weekly partitions are premature at v0.4 scale; ship a plain table with `(path, window_start)` index. Add partitioning post-pilot. | +| `operators`, `issued_credentials`, `mastery_gate_events`, `cohort_aggregates`, `issuer_keys` tables | D-050..D-053 confirmed | **CONFIRMED** — schema holds; column names refined (learner_ref vs learner_id) | +| CT memory 4GB → 6GB | D-050 + REQ-NFR-MT-01 | **CONFIRMED** — 6GB is sufficient | +| `pg_dump -Fc` to `pgbackups` volume, `%u` 7-file retention | D-055 confirmed | **CONFIRMED** — but host-side cron (not in-process) for decoupling | +| Secure cookie requires TLS (R-AUTH-01) | D-056 + D-030: config-driven `Secure` flag | **REFINED** — config-driven flag is the v0.4 resolution; v0.3 flagged it as an open question | +| VC issuer key in Postgres `issuer_keys` (encrypted at rest) | D-042 + D-051 confirmed | **CONFIRMED** — plus the migration path (archive v0.3 public key as superseded) | +| `gen_random_uuid()` in PG16 (no extension) | Verified | **CONFIRMED** | +| React `/operator/*` route, reuses v0.2 StaticFiles | D-044 + D-053 confirmed | **CONFIRMED** — plus SPA fallback requirement (new) | +| on-session-end hook + nightly reconciliation | D-045 + D-054 confirmed | **CONFIRMED** — D-054 clarifies async fire-and-forget + 03:00 CT | + +**Summary:** 2 overturned (asyncpg min_size, weekly partitions), 1 refined (Secure cookie → config-driven), 11 confirmed. + +--- + +## New pip dependencies for v0.4 + +| Dep | Purpose | Confidence | Source | +|-----|---------|------------|--------| +| `asyncpg>=0.29` | Postgres async driver / pool | 0.90 | D-050 | +| `argon2-cffi>=23.1` | argon2id password hashing | 0.95 | D-041, OWASP | +| `slowapi>=0.1` | login rate limiting (in-memory) | 0.70 | D-041, D-057 | + +`starlette` + `itsdangerous` already via FastAPI. `pynacl`, `canonicaljson`, `base58` already in `pyproject.toml` (v0.3). + +## New npm dependencies for v0.4 + +| Dep | Purpose | Confidence | Source | +|-----|---------|------------|--------| +| `react-router-dom@^7` | React routing for `/operator/*` | 0.80 | D-044 | + +No chart library — inline SVG sparklines (zero deps). + +--- + +## Open Questions for PLAN Stage + +1. **SPA fallback implementation:** Catch-all route before StaticFiles mount, or a custom StaticFiles subclass? The catch-all route is simpler but must not shadow `/api/*` or `/vc/*` routes. +2. **`IssuerKeyStore` protocol design:** ABC with methods, or a simpler duck-typing approach? The existing `PraxisStore` methods (`init_issuer_key`, `get_active_signing_key_row`, `get_public_key_row`, `set_issuer_key_superseded`) are the interface. +3. **Nightly scheduler:** In-process asyncio loop or host-side cron for the aggregation job? (pg_dump backup is host-side cron.) In-process is simpler for aggregation (shares the asyncpg pool); host-side is better for backup (decoupled from app uptime). +4. **`create-operator.py` update path:** `--update` flag to force rehash, or a separate `scripts/update-operator.py`? Keep it simple: `--update` flag on the same script. +5. **Cookie `path` scope:** `/` (cookie sent to all routes) or `/api/operator` (cookie sent only to operator API)? `/` is needed for the React `/operator/*` routes to call `/api/operator/me` on mount (the browser sends the cookie). Use `/`. +6. **Cohort aggregation `learner_ref` source:** The existing `HARDCODED_LEARNER_ID = "learner-1"` — is this stable enough for the aggregation? Yes for v0.4 (single learner); multi-learner-per-device is deferred. The aggregation groups by `learner_ref` so k-anonymity counts distinct learners. +7. **Phase split confirmation:** ROADMAP shows P1 (operator foundation: Postgres + auth) → P2 (cohort dashboard + aggregation) → P3 (review). Is the aggregation pipeline P1 or P2? D-045 + D-054 suggest the hook is P2 (needs the dashboard to be useful), but the Postgres schema + the on-session-end hook could be P1. **Recommendation:** P1 = Postgres + auth + VC key migration + schema (including `cohort_aggregates` table); P2 = aggregation pipeline (hook + nightly job) + dashboard UI + endpoints. The schema is P1 so P2 is pure code. \ No newline at end of file diff --git a/.ciagent/ROADMAP.md b/.ciagent/ROADMAP.md index 34a37cc..962aada 100644 --- a/.ciagent/ROADMAP.md +++ b/.ciagent/ROADMAP.md @@ -1,20 +1,64 @@ # Praxis — Roadmap -**Milestone:** v0.3 (Mastery scoring + competency rubrics + verifiable credentials) — complete -**Status:** milestone released as v0.1.5 (merged to main) -**Previous milestone:** v0.2 (Proxmox LXC deployment) — complete, tagged v0.1.2, release #377 +**Milestone:** v0.4 (Operator tier — cohort dashboard, auth, Postgres) — active +**Status:** phase 0 — specify (active milestone) +**Previous milestone:** v0.3 (Mastery scoring + competency rubrics + verifiable credentials) — complete, tagged v0.1.5, release #380, merged to main ## Milestone Philosophy -v0.3 activates the mastery/assessment layer deferred from v0.1/v0.2 (per D-021). Learners progress via **mastery gates** — they move on only when they can do the thing across varied scenarios, scored against a competency rubric. On week-final gate-open, a **formative verifiable credential** (W3C VC 2.0, Ed25519) is issued so mastery is portable. The v0.2 LXC deployment carries forward unchanged. **Operator tier (cohort dashboard + auth + Postgres) is deferred to v0.4** per the grill's binding verdict (GRILL-v0.3.md Axis 2 — the operator tier was originally v0.8 on this roadmap; pulling it into v0.3 created a 2-milestone program disguised as one). +v0.4 activates the operator tier deferred from v0.3 per the grill's binding verdict (GRILL-v0.3.md Axis 2 — the operator tier was originally v0.8 on this roadmap; pulling it into v0.3 created a 2-milestone program disguised as one). v0.4 layers the operator surface on top of the v0.3 mastery/VC/scenario work: a Postgres store in the existing LXC CT, operator auth (argon2id session cookies), a cohort aggregation pipeline (k-anonymity ≥ 10, 7-day windows), and a React cohort dashboard served by the same FastAPI server. The learner-facing surface carries forward unchanged (SQLite, voice loop, mastery gates, VC issuance). The VC issuer key store migrates from SQLite to operator-tier Postgres + secrets (D-042). -## v0.3 Phases (post-grill) +## v0.4 Phases ### Phase 0 — Pre-Execution (in-progress — this phase) +**Branch:** `phase/00-pre-execution` → merged to `milestone/v0.4-operator-tier` +**Ship target:** `v0.1.6` (patch release on v0.3's v0.1.x line — NFR/docs milestone type) +**Status:** in-progress (SPECIFY) + +Pipeline stages: SPECIFY → CLARIFY → RESEARCH → PLAN → GRILL → SHIP + +**Goal:** Produce all `.ciagent/` planning artifacts for v0.4: activated requirements (REQ-MT-01/02, REQ-AUTH-01, REQ-DASH-01 + 4 NFRs), research-grounded Postgres-in-LXC + k-anonymity + argon2id + React-dashboard architecture, persona roster (frontend-engineer + data-engineer reactivated, security-engineer retained), vertical-slice plan for P1/P2. + +**Deliverables:** +- PROJECT.md (v0.4 scope validated; operator tier activated) +- REQUIREMENTS.md (v0.4 active REQ-IDs = 8; v0.3 marked complete) +- ARCHITECTURE.md (operator Postgres + auth + cohort dashboard + aggregation pipeline added to v0.3 topology) +- PERSONAS.md (v0.4 roster — frontend-engineer + data-engineer reactivated for dashboard + Postgres; security-engineer retained for auth/crypto; devops-engineer for Postgres-in-LXC) +- GRILL-v0.4.md (adversarial review — auth + PII surface warrants grill) +- Phase 1 + Phase 2 plans (vertical slices with wave ordering) + +### Phase 1 — Operator Foundation (Postgres + Auth) (planned) + +**Branch:** `phase/01-operator-foundation` → merged to `milestone/v0.4-operator-tier` +**Ship target:** `v0.1.7` (patch release, feature milestone type) +**Status:** planned + +**Goal:** Operator-tier Postgres 16 running as a second Docker service in the existing LXC CT (internal network only), operator auth (argon2id session cookies, single `operator` role, login rate-limited), VC issuer key store migrated to Postgres + secrets. Foundation for the cohort dashboard in P2. No UI yet — API + DB + auth only. + +### Phase 2 — Cohort Dashboard + Aggregation (planned) + +**Branch:** `phase/02-cohort-dashboard` → merged to `milestone/v0.4-operator-tier` +**Ship target:** `v0.1.8` (patch release, feature milestone type) +**Status:** planned + +**Goal:** Cohort aggregation pipeline (on-session-end hook + nightly reconciliation, k-anonymity ≥ 10, 7-day windows) + React cohort dashboard under `/operator/*` (served by same FastAPI, reuses v0.2 StaticFiles) + `/api/operator/*` endpoints (auth-gated). Dashboard shows anonymized practice/mastery/failure-pattern views with cells < 10 learners suppressed. + +### Final Phase (P3) — Review + Ship (planned) + +**Branch:** `phase/03-final-review-ship` → merged to `milestone/v0.4-operator-tier` → merged to `main` +**Ship target:** final patch = v0.4 milestone release +**Status:** planned + +**Goal:** Multi-persona code review, project audit, milestone merge to main, milestone release. + +## v0.3 Milestone (complete — released as v0.1.5, reference) + +### Phase 0 — Pre-Execution (complete — tagged v0.1.3, release #378) + **Branch:** `phase/00-pre-execution` → merged to `milestone/v0.3-mastery-scoring` -**Ship target:** `v0.1.3` (patch release on v0.2's v0.1.x line — NFR/docs milestone type) -**Status:** in-progress (PLAN — grill-amended) +**Ship target:** `v0.1.3` (patch release, NFR milestone type — docs/planning only) +**Status:** complete (v0.1.3 tagged, Gitea release #378 created) Pipeline stages: SPECIFY → CLARIFY → RESEARCH → PLAN → GRILL → SHIP @@ -28,26 +72,22 @@ Pipeline stages: SPECIFY → CLARIFY → RESEARCH → PLAN → GRILL → SHIP - GRILL-v0.3.md (4 MUST conditions resolved, 5 FIX tracked) - Phase 1 plan (9 slices, 5 waves, ~40 tasks, 13/13 REQ coverage) -### Phase 1 — Mastery Core + VC Issuance (planned) +### Phase 1 — Mastery Core + VC Issuance (complete — tagged v0.1.4, release #379) **Branch:** `phase/01-mastery-core` → merged to `milestone/v0.3-mastery-scoring` **Ship target:** `v0.1.4` (patch release, feature milestone type) -**Status:** planned +**Status:** complete (v0.1.4 tagged, Gitea release #379 created; 13/13 REQ covered, 4/4 grill MUSTs satisfied) **Goal:** Competency rubric engine + Mastery Score computation + scenario library (≥6 CS scenarios) + dynamic difficulty (IRT) + Customer Service path (6 weeks) + verifiable-credential issuer (W3C VC 2.0, Ed25519, SQLite-backed, formative-tier, public verification). All learner-facing. 9 slices, 5 waves, ~40 tasks. -### Final Phase (P2) — Review + Ship (planned) +### Final Phase (P2) — Review + Ship (complete — tagged v0.1.5, release #380, merged to main) **Branch:** `phase/02-final-review-ship` → merged to `milestone/v0.3-mastery-scoring` → merged to `main` **Ship target:** final patch = v0.3 milestone release -**Status:** planned +**Status:** complete (v0.1.5 tagged, Gitea release #380 created, merged to main; review APPROVE_WITH_NOTES, audit HEALTHY) **Goal:** Multi-persona code review, project audit, milestone merge to main, milestone release. -## v0.4 Milestone (planned — operator tier, deferred from v0.3 per grill) - -v0.4 activates the operator tier deferred from v0.3: REQ-DASH-01 (cohort dashboard), REQ-AUTH-01 (operator auth), REQ-MT-01/02 (Postgres + aggregation), + 4 NFRs. This restores the original ROADMAP intent (dashboard was v0.8) while following the grill's "split the milestone" verdict. - ## v0.2 Milestone (complete — reference) ### Phase 0 — Pre-Execution (complete — tagged v0.1.0, release #371) @@ -75,11 +115,11 @@ Pipeline stages: SPECIFY → CLARIFY → RESEARCH → PLAN → GRILL **Goal:** A working `lxc-deploy.sh` orchestrator that clones a Debian template from the Proxmox cluster, configures the CT with Docker + nesting, builds/loads the praxis Docker image on first boot, starts the service via systemd, and health-checks `/health` :8789 — all idempotent with rollback on failure. -### Final Phase (P2) — Review + Ship (in-progress — this phase) +### Final Phase (P2) — Review + Ship (complete — tagged v0.1.2, release #377, merged to main) **Branch:** `phase/02-final-review-ship` → merged to `milestone/v0.2-lxc-deploy` → merged to `main` **Ship target:** final patch = v0.2 milestone release -**Status:** in-progress (audit running; no P2 commits yet on v0.2 phase/02 branch) +**Status:** complete (v0.1.2 tagged, Gitea release #377 created, merged to main) **Goal:** Multi-persona code review, project audit, milestone merge to main, milestone release. @@ -87,17 +127,15 @@ Pipeline stages: SPECIFY → CLARIFY → RESEARCH → PLAN → GRILL v0.1 was the **foundation milestone** — minimal viable voice loop (one persona, one scenario, ASR+TTS+LLM round-trip, single learner state). Shipped as `v0.0.0` (phase 0) → `v0.0.1` (phase 1) → `v0.0.2` (final/milestone release). -## Future Milestones (post-v0.2, indicative) +## Future Milestones (post-v0.4, indicative) | Milestone | Scope (indicative) | |-----------|-------------------| -| v0.3 | Mastery scoring + competency rubrics for the Customer Service path (deferred from original v0.2) | -| v0.4 | Second scenario + second persona; Drill Mode | | v0.5 | Live Assist on-the-job companion | | v0.6 | Low-bandwidth surfaces (WhatsApp, offline cache) | | v0.7 | Multi-language (French-Canadian, then PRD's 10-language list) | -| v0.8 | Employer / program dashboard | -| v0.9 | Credentialing (verifiable, shareable) | +| v0.8 | Full operator-suite dashboard (REQ-DASH-02 — beyond v0.4's foundational cohort view) | +| v0.9 | Credentialing (third-party verifiable, shareable) | | v1.0 | Working, tested product — multiple paths, multi-market, production-ready | These are indicative and will be refined by ci-roadmapper at the start of each milestone. \ No newline at end of file diff --git a/.ciagent/config.json b/.ciagent/config.json index c5a6c47..d1317cf 100644 --- a/.ciagent/config.json +++ b/.ciagent/config.json @@ -3,8 +3,8 @@ { "slug": "praxis", "name": "Praxis", - "milestone": "v0.3", - "status": "milestone-complete" + "milestone": "v0.4", + "status": "active" } ], "active_project": "praxis",